Re: Snowhite and the Seven Dwarfs - The REAL story!

[Kutulu]

As has been discussed on the list already, this is a well known Win32
trojan horse program.  It replaces the Windows 32-bit Winsock library
with it's own code and sends these emails out during normal operation
(possibly whenever other emails are sent, or whenever Windows boots,
etc.)

The SMTP headers, as far as I'm aware, don't get forged in any way, so
if someone is bored enough, you can try to track down whoever is
infected and let them know.  Or else, just delete these things.

--Kutulu

----- Original Message -----
From: <address@hidden>
To: <address@hidden>
Sent: Monday, January 22, 2001 5:16 PM
Subject: Re: Snowhite and the Seven Dwarfs - The REAL story!


> On Mon, 22 Jan 2001, Hahaha wrote:
>
> > Today, Snowhite was turning 18. The 7 Dwarfs always where very
educated and
> > polite with Snowhite. When they go out work at mornign, they
promissed a
> > *huge* surprise. Snowhite was anxious. Suddlently, the door open,
and the Seven
> > Dwarfs enter...
> >
> >
>
> Looks strange to spam a non-windows list with a .exe attachment.
> "strings" on the attachment reveals these:
>
> MIME-Version: 1.0
> Content-Type: multipart/mixed; boundary="
> Content-Type: text/plain; charset="us-ascii"
> Content-Type: application/octet-stream; name="
> Content-Transfer-Encoding: base64
> Content-Disposition: attachment; filename="
>
> I wonder to whom that executable would be sending e-mails too...
>
> s.
>
>
>
> _______________________________________________
> Bug-glibc mailing list
> address@hidden
> http://mail.gnu.org/mailman/listinfo/bug-glibc
>