WARNING

ma2va92

Forum Lieutenant
186
1
0
I personally checked this against www.snopes.com , and it's for real.

Warning

Emails with pictures of Osama Bin-Laden hanged are being sent and the moment that you open these emails your computer will crash and you will not be able to fix it!!!

This e-mail is being distributed through countries around the globe, but mainly in the US and Israel.

Don't be inconsiderate; send this warning to whomever you know.

Confirmed at: http://www.snopes.com/computer/virus/osama.asp

Origins: There are few headlines that would grab the ! attention of more
computer users around the world than "Osama bin Laden Captured," and
that's exactly what whoever created this lure was counting on to snare
unsuspecting victims who use Microsoft platforms.

"Osama bin Laden Captured" isn't a virus in itself; it's the text of a
message that includes a link to a file called EXPLOIT.EXE. When a
message recipient clicks on this link to view what he thinks are pictures of
Osama bin Laden's capture, he can end up downloading an executable Trojan
known as Backdoor-AZU, BKDR_LARSLP.A, Download.Trojan,
TrojanProxy.Win32.Small.b,or Win32.Slarp.< BR>
Clicking the embedded link in the "Osama bin Laden Captured" message
auto-executes a file called "EXPLOIT.EXE," which exploits a known
security hole to download the Trojan. According to McAfee Security:


The Trojan opens a random port on the victim's machine. It sends the
Port information to a webpage at IP address 66.139.77.145. The Troj! an
listens on the open port for instructions and redirects traffic to other IP
addresses.
Spammers and hackers can take advantage of compromised systems by using
the infected computer as a middleman, allowing them to pass information
through it and remain anonymous.


Microsoft has made available updates that close the hole exploited by
this Trojan.
 

TTLWHKR

Forum Deputy Chief
3,142
5
0
Well, if someone is stupid enough to download a picture from someone they don't know, then they'll get a virus eventually anyway.

The IP address comes back to the "Equine Exchange"

equinixexchange.ir1.dallas2-tx.us.xo.net

IPREPORT.jpg
 
Top