Re: [Full-disclosure] Re: pnp worm unknown variant - post infection actions

[Nick FitzGerald <nick@xxxxxxxxxxxxxxxxxxx>]

Jason Coombs to me:

> Very good points, but can you think of another worm that downloaded XXX 
> spyware/adware ?

I can't give you a specific name -- when I first saw it it didn't 
strike me as any more significant than the warez and porn FTP servers 
I'd seen years earlier, so didn't make specific note of it -- but there 
have been many.  We see new bots every day (many dozen a week) that are 
issued orders on joining the C&C network to install all manner of 
adware, spyware, click-for-dosh agents and so on.  Among those there 
will be many things dealing in "XXX" content but often analysis doesn't 
even go so far as checking that the target URL is still reachable...


-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3267092

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/