C y b e r C a f e 2 1 @ l i s t s . E x M a c h i n a . n e t !
<http://www.cybercafe21.net> & <http://www.cybercafe21.tv>
Voici le texte :
This mass-mailing worm is embedded inside a .PDF file. However, as it
requires the full version of Adobe Acrobat in order to propagate, it is
unlikely to become wide spread. Having just the Acrobat reader will not
spread the worm. VBS/PeachyPDF@MM arrives in an email message containing
random information. Below is a list of strings that are chosen at random to
make up the various parts of the message
Subject:
May start with: "Fw: "
May contain: "You have one minute to find the peach", or "Find the peach",
or "Find", or "Peach", or "Joke"
May end with: "!", or "> "
Body:
May start with: "> "
May contain: "Try finding the peach", or "Try this", or "Interesting
search", or "I don't usually send this things, but...", or any one of the
subject lines
May end with: "!", or " :-)", or " :)", or " =)", or " :-]"
Attachment: "find.pdf ", or "peach.pdf", or "find the peach.pdf", or
"find_the_peach.pdf", or "joke.pdf", or "search.pdf"
Opening the attached .PDF file will display a document which reads, "You
have one minute to find the peach!". A collogue containing images of naked
female buttocks is displayed, one of which is actually the image of a peach.
An icon entitled, "Double click the icon to show the solution" is also
present. If the user has only the Acrobat Reader, this icon is disabled. If
the user has the full version of Acrobat, double-clicking it will result in
the creation and execution of the VBScript worm file (Peach.vbs, Peach.vbe,
or Peach.wsf [depending of the version of the worm]).
This VBScript file creates a GIF image named PEACH.JPG and attempts to open
it. As this filename contains the wrong extension, a broken image may appear
in your browser/image viewer. The image is supposed to display where the
real peach is located, "LINE 1,picture 6". The worm checks for the presence
of a registry key before proceeding. If this key is present the script
quits, otherwise it creates it:
HKLM\Software\OUTLOOK.PDFWorm\
The script then scans for the location of the infectious .PDF file on the
hard drive and uses that path when mailing itself out from the infected
machine. Email addresses are gathered from all of the email messages found
in the Microsoft Outlook Mail Items folders (Inbox, Sent Items, etc), as
well as the Contacts folder. A new email message is created as described
above and the first 100 recipients found are BCCed to the message before it
is sent.
Indications Of Infection:
- Display of a PDF document containg the text: "You have one minute to find
the peach!"
- Presence of the file PEACH.JPG in the WINDOWS TEMP directory
- Acrobat users may see this warning message:
Pascal aka Jeck ki en bon crétin ne pèche jamais le dimanche
----- Original Message -----
From: "Denomerenge Bruno" <[EMAIL PROTECTED]>
> Quel est son "activité" favorite à ce virus pdf (je n'ai pas la
possibilité
> d'aller sur l'adresse mentionnée) ?
> BD
> -----Message d'origine-----
> De: [EMAIL PROTECTED] <[EMAIL PROTECTED]>
> ... premier virus à se propager via un fichier PDF.
>
> http://vil.mcafee.com/dispVirus.asp?virus_k=99179&;
>
>
> Angel
>
> ... qui, en acrobate, jongle avec les fruits :)))
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
La liste CC21 vous est offerte par Emakina <http://www.emakina.com/>
Pour vous desabonner rapido <mailto:[EMAIL PROTECTED]>
