[prev in list] [next in list] [prev in thread] [next in thread] 

List:       dshield
Subject:    Re: [Dshield] Exploit from somewhere?
From:       lucy () lucindrea ! com
Date:       2006-05-17 21:10:13
Message-ID: 4216.64.0.107.243.1147900213.squirrel () 64 ! 0 ! 107 ! 243
[Download RAW message or body]

ya well i had been awake for 25 hours when i wrote that ( switch crashed
)so my brain may of not been working properly :) .. BUT removeme is common
in e-mails for a removal link so i dont look too bad hehe


> I think the REMOVEME part was addded by the author so that people
> wouldn't accidentally click on that link.
>
>
>
> --
>
> Taps@Iniquity.Org
> http://Taps.Iniquity.Org
> -  "What spirit is so empty and blind, that it cannot recognize the fact
> that the foot is more noble than the shoe, and skin more beautiful than
> the garment with which it is clothed?"
>  -- Michaelangelo
>
> -  "Build a man a fire, and he'll be warm for a day. Set a man on fire,
> and he'll be warm for the rest of his life."
>  -- Terry Pratchett
>
>
>> -----Original Message-----
>> From: list-bounces@lists.dshield.org
>> [mailto:list-bounces@lists.dshield.org] On Behalf Of
>> lucy@lucindrea.com
>> Sent: Wednesday, May 17, 2006 1:13 AM
>> To: General DShield Discussion List
>> Cc: list@lists.dshield.org
>> Subject: Re: [Dshield] Exploit from somewhere?
>>
>>
>>
>> well looks like zedo.com is a advert. agency .. it also looks like
>> removeme.zedo.com and all canmes of that are no longer resolvable.
>>
>>
>> >
>> >
>> http://c5.REMOVEME.zedo.com/jsc/c5/ff2.html?n=377;c=67;s=17;w=468;h=60
>> >
>> > tries to load the turd Trojan-Downloader.HTML.Agent.ae from
>> > topinstalls.com spyware outfit.
>> >
>> > But from where?  I can not figure out
>> > from viewing the output of wget or otherwise what is
>> actually doing it.
>> >
>> >>From firefox there is definitely an iframe or other
>> suspicious little box
>> > there....
>> >
>> >
>> >
>> > _________________________________________
>> >
>> > SANSFIRE 2006 - Meet ISC Handlers in Person -
>> > Learn about the latest in Information Security from the
>> best instructors
>> > in the world.
>> >
>> > http://www.sans.org/sansfire006
>> >
>> > Internet Storm Center Webcasts: http://www.sans.org/webcasts . Every
>> > Wednesday after patch-tuesday.
>> > _______________________________________________
>> > send all posts to list@lists.dshield.org
>> > To change your subscription options (or unsubscribe), see:
>> > http://www.dshield.org/mailman/listinfo/list
>> >
>>
>>
>> --
>> Time to revamp Kindergarten
>>
>> 1. Sharing is ILLEGAL
>> _________________________________________
>>
>> SANSFIRE 2006 - Meet ISC Handlers in Person -
>> Learn about the latest in Information Security from the best
>> instructors in the world.
>>
>> http://www.sans.org/sansfire006
>>
>> Internet Storm Center Webcasts: http://www.sans.org/webcasts
>> . Every Wednesday after patch-tuesday.
>> _______________________________________________
>> send all posts to list@lists.dshield.org
>> To change your subscription options (or unsubscribe), see:
>> http://www.dshield.org/mailman/listinfo/list
>>
>
> _________________________________________
>
> SANSFIRE 2006 - Meet ISC Handlers in Person -
> Learn about the latest in Information Security from the best instructors
> in the world.
>
> http://www.sans.org/sansfire006
>
> Internet Storm Center Webcasts: http://www.sans.org/webcasts . Every
> Wednesday after patch-tuesday.
> _______________________________________________
> send all posts to list@lists.dshield.org
> To change your subscription options (or unsubscribe), see:
> http://www.dshield.org/mailman/listinfo/list
>


-- 
Time to revamp Kindergarten

1. Sharing is ILLEGAL
_________________________________________

SANSFIRE 2006 - Meet ISC Handlers in Person -
Learn about the latest in Information Security from the best instructors in the world.

http://www.sans.org/sansfire006

Internet Storm Center Webcasts: http://www.sans.org/webcasts . Every Wednesday after patch-tuesday.
_______________________________________________
send all posts to list@lists.dshield.org
To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list
[prev in list] [next in list] [prev in thread] [next in thread]