Re: [Full-Disclosure] Email Harvesting virus?

[Blue Boar <BlueBoar@thievco.com>]

Joel R. Helgeson wrote:

> A customers machine appears to be infected with some type of malware 
> that apparently harvests email addresses and puts them into a file named 
> '~'.  Just the tilde ~, no extention.  This file is created under the 
> C:\Documents and Settings\%username%\~.  I have attached a zipped copy 
> of the file for refrence.
>  
> I came across the file earlier today, renamed it and copied it off to a 
> keychain USB drive for later analysis. Well, the file re-created itself 
> and the malware creating it is not immediately apparent.  I've scanned 
> all the running apps but I haven't had much time to investigate.
>  
> Any ideas?

Microsoft Word? :) It appears to be one of the backup files that Word makes 
while you are working.

						BB

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html