<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE id=ridTitle>Blank</TITLE>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<STYLE>BODY {
MARGIN-TOP: 25px; FONT-SIZE: 10pt; MARGIN-LEFT: 25px; COLOR: #000000; FONT-FAMILY: Arial, Helvetica
}
P.msoNormal {
MARGIN-TOP: 0px; FONT-SIZE: 10pt; MARGIN-LEFT: 0px; COLOR: #ffffcc; FONT-FAMILY: Helvetica, "Times New Roman"
}
LI.msoNormal {
MARGIN-TOP: 0px; FONT-SIZE: 10pt; MARGIN-LEFT: 0px; COLOR: #ffffcc; FONT-FAMILY: Helvetica, "Times New Roman"
}
</STYLE>
<META content="MSHTML 6.00.2800.1458" name=GENERATOR></HEAD>
<BODY id=ridBody background=cid:643254204@24082004-089d>
<BLOCKQUOTE dir=ltr
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma><SPAN
class=643254204-24082004><FONT face=Arial><FONT color=#ff0000>do you know that
</FONT><A href="http://www.slimeware.com"><FONT
color=#ff0000>www.slimeware.com</FONT></A><FONT color=#ff0000> is a paranody
site with no real coproation behind it, the fellow who wrote this program has
a real good sence of humor </FONT></FONT></SPAN></FONT></DIV>
<DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Arial
color=#ff0000><SPAN class=643254204-24082004></SPAN></FONT> </DIV>
<DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Arial
color=#ff0000><SPAN class=643254204-24082004></SPAN></FONT> </DIV>
<DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Arial><SPAN
class=643254204-24082004></SPAN></FONT> </DIV>
<DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Arial><SPAN
class=643254204-24082004></SPAN></FONT> </DIV>
<DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma><SPAN
class=643254204-24082004><FONT
face=Arial> </FONT></SPAN>-----Original
Message-----<BR><B>From:</B> Swearingen, Bill W [CC]
[mailto:bill.p.swearingen@mail.sprint.com]<BR><B>Sent:</B> Tuesday, August 24,
2004 01:01 AM<BR><B>To:</B> ald2003@users.sourceforge.net;
full-disclosure-admin@lists.netsys.com<BR><B>Subject:</B> RE:
[Full-Disclosure] Possible New Malware....<BR><B>Sensitivity:</B>
Confidential<BR><BR></DIV></FONT>
<DIV dir=ltr align=left><SPAN class=487402719-23082004>Taking a look at
RunDLL32e.txt shows the name "slimeware corp"</SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=487402719-23082004></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=487402719-23082004>Doing a google search I
found http:// www. slimeware. com/downloads.htm</SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=487402719-23082004></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=487402719-23082004>In their License
Agreement they state this:</SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=487402719-23082004></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=487402719-23082004>* This is a
legally binding agreement between yourself "you" and Slimeware Corporation
"Slimeware".<BR></SPAN></DIV><!-- Converted from text/rtf format -->
<P align=left><SPAN lang=en-us><A
href="http://csweb.corp.sprint.com/alerts"></A><<SPAN
class=643254204-24082004> OTHER DETAILS
SNIPPED> </SPAN></SPAN><SPAN lang=en-us><SPAN
class=643254204-24082004></SPAN></SPAN></P>
<DIV> </DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma><B>From:</B> full-disclosure-admin@lists.netsys.com
[mailto:full-disclosure-admin@lists.netsys.com] <B>On Behalf Of </B>Aditya ,
ALD [ Aditya Lalit Deshmukh ]<BR><B>Sent:</B> Monday, August 23, 2004 10:04
AM<BR><B>To:</B> Full-Disclosure@Lists. Netsys. Com<BR><B>Subject:</B>
[Full-Disclosure] Possible New Malware....<BR><B>Importance:</B>
High<BR><B>Sensitivity:</B> Confidential<BR></FONT><BR></DIV>
<DIV></DIV>
<P><SPAN class=601285914-23082004>Hi List, Possible new malware makes startup
entries and copies itself to the windows folder this is where it was found,
creates a CurruntPowerProfile reg startup key with a value of
Rundll32.exe,powrprof.dll,LoadCurrentPwrScheme2.exe cant find anything else
that it is doing except that it is written in VB anyone willing to have a look
at it ? the files are attached as they are just ~ 40 KB -aditya ( simply
ren *.txt to *.exe ) </SPAN></P></BLOCKQUOTE></BODY></HTML>