Unix.Penguin

[fuckoffmicrosoft]

LMFAO that server wasnt up 3 hours before i foubd this on my wifes pc and i figure that the only i couldve gotten it was by the distro ftp site i downloaded from http://securityresponse.symantec.com/avcenter/venc/data/unix.penguin.html is there a way to further prevent this from happenig?

[fuckoffmicrosoft]

found the culprit "The compressed file WRITING-PURECFG within C:\Documents and Settings\lee\Desktop\redhat\kcmpureftpd-0.6.tar within C:\Documents and Settings\lee\Desktop\redhat\kcmpureftpd-0.6.tar.gz is infected with the Unix.Penguin virus."

[ September 27, 2002: Message edited by: fuckoffmicrosoft ]

[ September 27, 2002: Message edited by: fuckoffmicrosoft ]

[voidmain]

Maybe if you wouldn't run Windows you wouldn't have to worry about these things.

[Master of Reality]

Thtas all i have to do from stop the daily re-isntallation of windows?!!! Why didnt anyone tell me this sooner. And to think of all those viru and hardrive image saving. The answer all along was to simply get rid of windows!!!!!.

[lazygamer]

Now that's what I call a pathetic virus. The author is so sure of his inability to do REAL damage in Linux that he has to hope someone mails out the root password? Now that's what I call secure!

[Master of Reality]

of course, there is no way to do damage with a virus. Luckily most recent distros use shadowed passwords so mailing out /etc/passwd wont really gain them anything.

[Bazoukas]

Who the hell will send out their root password?

 That script kiddie must have been smoking some realy cheap ass weed.

[Master of Reality]

its a fucking trojan. Someone runs a script that happens to have a line that will mail /etc/passwd to the script kiddie. The fucking owner of the computer has no idea that the script he just ran sent out his root passowrd (unless he is smart and checks logs).

[voidmain]

The owner of this computer (me) would never run a script sent to him in an email. Surely without first looking at the code. You gotta be some kinda stupid to fall for something like this.

[voidmain]

Yeah, who (besides a Lindows user) would read their email as root, not that a script can be automatically executed anyway.  You need root access to view /etc/shadow which is where the encrypted passwords reside.

[Master of Reality]

it would only work if it were an older distro that didnt have shadowed passowrds then? (just like i mentioned in my previous post).
It would be a script that is on a site that looks legitimate and is supposed to (and does) something useful like an administration script but also sends out your /etc/passwd but most people wouldnt run a script they thought to be legitamite anyway without looking at the code first.

[voidmain]

Linux has been using shadowed passwords for years. I missed your previous post that mentioned it. Sorry bout that!