From owner-freebsd-jobs Wed May 24 18:13:17 2000 Delivered-To: freebsd-jobs@freebsd.org Received: from ogopogo.flash.net (ogopogo.flash.net [209.30.2.14]) by hub.freebsd.org (Postfix) with ESMTP id 7FF5137B583 for ; Wed, 24 May 2000 18:13:13 -0700 (PDT) (envelope-from wotan@fosburgh.org) Received: from gw.fosburgh.org (p29.amax36.dialup.hou1.flash.net [209.30.72.29]) by ogopogo.flash.net (8.9.3/Pro-8.9.3) with ESMTP id UAA29689; Wed, 24 May 2000 20:13:06 -0500 (CDT) Received: from localhost (wotan@localhost) by gw.fosburgh.org (8.9.3/8.9.3) with ESMTP id UAA71665; Wed, 24 May 2000 20:13:06 -0500 (CDT) (envelope-from wotan@ns.fosburgh.org) Date: Wed, 24 May 2000 20:12:12 -0500 (CDT) From: Jonathan E Fosburgh Reply-To: fosburgh@flash.net To: "Vladislav S. Davidzon" Cc: jobs@FreeBSD.ORG Subject: RE: CRACK In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-jobs@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Wed, 24 May 2000, Vladislav S. Davidzon wrote: > Looks like a trojan horse to me... I've reported it to CERT. > > > REGEDIT4 > [HKEY_CURRENT_USER\Software\Mirabilis\ICQ\DefaultPrefs] > "Default Server Port"=dword:00001446 > "Default Server Host"="195.133.10.234" > > -----Original Message----- > From: owner-freebsd-jobs@FreeBSD.ORG > [mailto:owner-freebsd-jobs@FreeBSD.ORG]On Behalf Of Jonathan Fosburgh > Sent: Wednesday, May 24, 2000 5:11 PM > To: zulti@hotmail.com; jobs@FreeBSD.ORG > Subject: Re: CRACK > > > ----- Original Message ----- > From: > To: > Sent: Wednesday, May 24, 2000 8:01 PM > Subject: CRACK > > Why is someone sending a Windows registry entry to the list? If you are > reading this on Windows, do not open the attachment. If you have already > done so, delete the entry in > HKEY_CURRENT_USER\Software\Mirabgilis\ICQ\DefaultPrefs. > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-jobs" in the body of the message > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-jobs" in the body of the message > > I wonder what it does if you use Mirabilis ICQ. That IP traces to a dial-up in Russia. Jonathan Fosburgh Open Systems MD Anderson Cancer Center Houston, TX Home Page: http://www.fosburgh.org Manager, FreeBSD Webring: http://www.fosburgh.org/computer/freebsdring.html ICQ: 32742908 AIM: Namthorien To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-jobs" in the body of the message