[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[no subject]
- <!--x-content-type: text/plain -->
- <!--x-date: Fri May 27 10:08:02 2005 -->
- <!--x-from-r13: Rbj.Vhefg ng zvaqfcevat.pbz (Rbj Vhefg) -->
- <!--x-message-id: [email protected] -->
- <!--x-reference: 1117137296.11283.33.camel@localhost -->
- <!--x-reference: [email protected] -->
- <!--x-reference: 1117201561.6152.9.camel@localhost --> "http://www.w3.org/TR/html4/loose.dtd">
- <!--x-subject: [ale] javascript Virus -->
- <li><em>date</em>: Fri May 27 10:08:02 2005</li>
- <li><em>from</em>: Dow.Hurst at mindspring.com (Dow Hurst)</li>
- <li><em>in-reply-to</em>: <1117201561.6152.9.camel@localhost></li>
- <li><em>references</em>: <1117137296.11283.33.camel@localhost> <<a href="msg00979.html">[email protected]</a>> <1117201561.6152.9.camel@localhost></li>
- <li><em>subject</em>: [ale] javascript Virus</li>
Jim Popovitch wrote:
>On Fri, 2005-05-27 at 09:11 -0400, Dow Hurst wrote:
>
>
>>I don't know Javascripting at all but how does this work? I would like
>>to know how to see that this is dangerous but it looks like gobbledegook
>>to me. There is no IP given nor filename to download?
>>
>>
>
>
>WARNING: DO NOT VISIT THE SITES IDENTIFIED BELOW WITH A MICROSOFT
>WINDOWS PC.
>
>The gobbledegook is "ASCII encrypted" code that downloads an initial
>java file from h--p://81.222.131.59/dl/adv737.php. That file then
>downloads Win32 files from h--p://69.50.177.102/x155/ind.php, and
>ultimately h--p://69.50.177.102/x155/count5.htm. In the end you have
>(what I think is) Troj/Bumaf-F virus installed on your Windows PC
>(<a rel="nofollow" href="http://www.sophos.com/virusinfo/analyses/trojbumaff.html";>http://www.sophos.com/virusinfo/analyses/trojbumaff.html</a>)
>
>
>
>-Jim P.
>
>
>_______________________________________________
>Ale mailing list
>Ale at ale.org
><a rel="nofollow" href="http://www.ale.org/mailman/listinfo/ale";>http://www.ale.org/mailman/listinfo/ale</a>
>
>
>
</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<!--X-Follow-Ups-End-->
<!--X-References-->
<ul><li><strong>References</strong>:
<ul>
<li><strong><a name="00955" href="msg00955.html">[ale] javascript Virus</a></strong>
<ul><li><em>From:</em> jimpop at yahoo.com (Jim Popovitch)</li></ul></li>
<li><strong><a name="00979" href="msg00979.html">[ale] javascript Virus</a></strong>
<ul><li><em>From:</em> Dow.Hurst at mindspring.com (Dow Hurst)</li></ul></li>
<li><strong><a name="00984" href="msg00984.html">[ale] javascript Virus</a></strong>
<ul><li><em>From:</em> jimpop at yahoo.com (Jim Popovitch)</li></ul></li>
</ul></li></ul>
<!--X-References-End-->
<!--X-BotPNI-->
<ul>
<li>Prev by Date:
<strong><a href="msg00984.html">[ale] javascript Virus</a></strong>
</li>
<li>Next by Date:
<strong><a href="msg00986.html">[ale] Need Tractor Feed Dot Matrix printer</a></strong>
</li>
<li>Previous by thread:
<strong><a href="msg00984.html">[ale] javascript Virus</a></strong>
</li>
<li>Next by thread:
<strong><a href="msg00958.html">[ale] IPv6 for the Linksys WRT54G</a></strong>
</li>
<li>Index(es):
<ul>
<li><a href="maillist.html#00985"><strong>Date</strong></a></li>
<li><a href="threads.html#00985"><strong>Thread</strong></a></li>
</ul>
</li>
</ul>
<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</body>
</html>