Re: [tlug] OT ["Microsoft Corporation Security Center" <rdquest12@example.com>] Internet Security Update

["Eric O. Flores" <goripi@example.com>]

I also found such type of files.

Can't remember doing any updates on my Weksrv system, the files was found in 
the c:\winnt\system32 directory an application of 45Kb with a date or 
1993/06/30 an a date of 6PM Norton Antivirus show no report of this file 
being a virus.

Can it be to open the attached files with a hex editor in Linux?




??? 15 3? 2002 11:15?Stephen J. Turnbull ????????:
> Anybody know what this is?  It's presumably a virus, but which one?
>
> Nice to see them slipping right by that nasty ol' virus scanner
> (issv3).  ;-)

> X-From-Line: steve@example.com Fri Mar 15 06:45:19 2002
> Received: from turnbull.sk.tsukuba.ac.jp (localhost) [130.158.99.4] (root)
> 	by tleepslib.sk.tsukuba.ac.jp with esmtp (Exim 3.35 #1 (Debian))
> 	id 16ld2E-0002jZ-00; Fri, 15 Mar 2002 06:45:18 +0900
> Received: by localhost	id m16ld30-00015AC
> 	(Debian Smail-3.2.0.114 2001-Aug-6 #2); Fri, 15 Mar 2002 06:46:06 +0900 
(JST)
> Received: from shako.sk.tsukuba.ac.jp ([130.158.97.253]) by localhost
> 	 with esmtp id m16lcqy-00014gC
> 	(Debian Smail-3.2.0.114 2001-Aug-6 #2); Fri, 15 Mar 2002 06:33:40 +0900 
(JST)
> Received: from issv3.cc.tsukuba.ac.jp (issv3.cc.tsukuba.ac.jp 
[130.158.2.202])
> 	by shako.sk.tsukuba.ac.jp (8.10.2+Sun/3.7W) with ESMTP id g2ELXeL06510
> 	for <turnbull@example.com>; Fri, 15 Mar 2002 06:33:40 +0900 (JST)
> Received: from mailout6.nyroc.rr.com (localhost [127.0.0.1])
> 	by issv3.cc.tsukuba.ac.jp (8.11.6/3.7W11/29/01) with ESMTP id g2ELXZw25462
> 	for <turnbull@example.com>; Fri, 15 Mar 2002 06:33:36 +0900 (JST)
> Received: from pfuckie (roc-24-161-66-1.rochester.rr.com [24.161.66.1])
> 	by mailout6.nyroc.rr.com (8.11.6/Road Runner 1.12) with SMTP id 
g2ELWCu14448;
> 	Thu, 14 Mar 2002 16:32:42 -0500 (EST)
> Date: Thu, 14 Mar 2002 16:32:42 -0500 (EST)
> Message-Id: <200203142132.g2ELWCu14448@example.com>
> From: "Microsoft Corporation Security Center" <rdquest12@example.com>
> To: "Microsoft Customer" <'customer@example.com'>
> Subject: Internet Security Update
> Reply-To: <rdquest12@example.com>
> Lines: 2240
> Xref: tleepslib.sk.tsukuba.ac.jp nec:3060
> MIME-Version: 1.0
> Content-Type: multipart/mixed; boundary="===-=-="
> > Microsoft Customer,
>
>      this is the latest version of security update, the
>
> known security vulnerabilities affecting Internet Explorer and
> MS Outlook/Express as well as six new vulnerabilities, and is
> discussed in Microsoft Security Bulletin MS02-005. Install now to
> protect your computer from these vulnerabilities, the most serious of which
> could allow an attacker to run code on your computer.
>
>
> Description of several well-know vulnerabilities:
>
> [yada, yada, yada -- even MS can't be that bad spellers!]

-- 
Eric O. Flores
web site:  http://www.noacchi.dns2go.com
Work site:  http://www.fc-w.co.jp/english/index.html
"He is able who thinks he is able." 
-->Buddha