Re: [Full-disclosure] MSN Messanger Virus

[FpTargeT <fptarget@xxxxxxxxxxxx>]

> A friend of mine contacted me because his MSN Messenger started trying
> to send files to everyone on his contact list.  I signed on and it  
> send
> me this message:
>
> Mira las fotos >>> http://hometown.aol.com.au/miralafoto/ 
> imagens001.exe
>
> I've run a couple of virus scanners on this file with none of them  
> being
> able to figure out what it is.  Anyone have any clues?

Have you ever considered this file as a kind of pictures slideshow ?

Some windows pictures viewer allow people to build an executable  
diaporama of files, in order to help people receiving it to view it  
without any kind of knowledge...

First thing before contacting AOL should be to inform Antivirus  
software developpers to have this file and test it in a sandbox  
environment...

Just my little contribution on the subject ;-)

++
--
FpTargeT.



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/