[ale] New mail trojan (this IS Linux-related)

[Jerald Sheets]

Let's not forget thaty all those little applets in your Winblows control
panel are *.cpl files.  This is another extension tha will run, should
it get clicked on a Winblows box.

I'd say we're being *too* smart for the virus folk with this thread.  ;)

--jms

-----Original Message-----
From: ale-bounces at ale.org [mailto:ale-bounces at ale.org] On Behalf Of
Fulton Green
Sent: Wednesday, April 28, 2004 11:42 AM
To: Atlanta Linux Enthusiasts
Subject: Re: [ale] New mail trojan (this IS Linux-related)


On Wed, Apr 28, 2004 at 11:38:08AM -0400, Frank S. Glass wrote:
> Quoting Fulton Green <ale at FultonGreen.com>:
> 
> > I just received in my inbox a message sent from a Czech account 
> > masquerading as an official EarthLink message with a suspicous 
> > payload. Unlike most other mail trojans, this payload is in the form

> > of a compiled Perl script (assuming that's what the ".cpl" extension

> > stands for).
> > 
> 
> I'll bite.  How is this Linux related?  Is there some Linux MUA that 
> will run a script of this form directly or through Perl?

It's conceivable that someone could have a mailcap file configured to
have Perl interpret .cpl files (Charles Shapiro's recent comment
notwithstanding). _______________________________________________
Ale mailing list
Ale at ale.org
http://www.ale.org/mailman/listinfo/ale

---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.656 / Virus Database: 421 - Release Date: 4/9/2004
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.656 / Virus Database: 421 - Release Date: 4/9/2004