Warning! nasty one

[jen]

"pcbutts1" <pcbutts1@leythosthestalker.com> wrote in message
news:favdgl$n9o$1@blackhelicopter.databasix.com...
> I've seen this thing change group policy, expire passwords and modify
> the boot.ini. Warning Newbie's don't go here or you will be asking for
> help to get rid of it. 64_201_199_24 it arrives in email claiming to
> be a youtube video. Dustin you like **** like this have fun.

Storm of the Day, Now with YouTube:
http://isc.sans.org/diary.html?storyid=3321

-jen

[pcbutts1]

Yep, that be it.

--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell



"jen" <jen@example.com> wrote in message
news:aTGAi.36517$t9.31479@bignews7.bellsouth.net.. .
> "pcbutts1" <pcbutts1@leythosthestalker.com> wrote in message
> news:favdgl$n9o$1@blackhelicopter.databasix.com...
>> I've seen this thing change group policy, expire passwords and modify the
>> boot.ini. Warning Newbie's don't go here or you will be asking for help
>> to get rid of it. 64_201_199_24 it arrives in email claiming to be a
>> youtube video. Dustin you like **** like this have fun.
>
> Storm of the Day, Now with YouTube:
> http://isc.sans.org/diary.html?storyid=3321
>
> -jen
>

[Andy Walker]

jen wrote:

>"pcbutts1" <pcbutts1@leythosthestalker.com> wrote in message
>news:favdgl$n9o$1@blackhelicopter.databasix.com.. .
>> I've seen this thing change group policy, expire passwords and modify
>> the boot.ini. Warning Newbie's don't go here or you will be asking for
>> help to get rid of it. 64_201_199_24 it arrives in email claiming to
>> be a youtube video. Dustin you like **** like this have fun.
>
>Storm of the Day, Now with YouTube:
>http://isc.sans.org/diary.html?storyid=3321
>
>-jen

The article doesn't mention it but the IP addresses in the malicious
links are infected zombie computers located all over the world. I
haven't yet seen two the same in all the samples I've collected,
although it is clear that infected computers can send out numerous
emails.

The F-Secure weblog has been pretty good at keeping up on the new
variants http://www.f-secure.com/weblog/