[Esa-l]Here's a new one....

[Phil Pennock]

On 2001-05-09 at 09:20 -0600, Brett Glass wrote:
> Here's a Trojan I've never seen before.... Both our own ruleset
> and John's sanitizer triggered on it (output from John's is shown). 
> It looks to have been generated by the same toolkit that was used 
> to create the Anna Kournikova worm.

> REPORT: Trapped poisoned executable "homepage.HTML.vbs"

Just been discussed on <incidents at securityfocus.com> (one of the
companion lists to BugTraq).

Information on the worm is at:
<http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=VBS_HOMEPAGE.A>
-- 
Phil Pennock                        <pdp at nl.demon.net> <Phil.Pennock at thus.net>
Demon Internet Nederland -- Network Operations Centre -- Systems Administrator
Libertes philosophica.
NL Sales: +31 20 422 20 00                          NL Support: 0800 33 6666 8