<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]--><o:SmartTagType
namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="City"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="place"/>
<!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:SimSun;}
h1
{mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:24.0pt;
font-family:SimSun;
font-weight:bold;}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:blue;
text-decoration:underline;}
p
{mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:SimSun;}
pre
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:SimSun;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:Arial;
color:navy;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
/* List Definitions */
@list l0
{mso-list-id:148986235;
mso-list-template-ids:887239716;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1
{mso-list-id:887914205;
mso-list-template-ids:-1561537820;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
-->
</style>
</head>
<body lang=EN-US link=blue vlink=blue>
<div class=Section1>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Danny,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Let’s put your fears to rest. Zone.Identifier
ADS is related to the way Windows tags files generated by Internet Explorer and
Outlook when saving content downloaded from different security zones (you know –
the Security tab under IE Internet Options). This tag is then referenced
when Windows accesses a file to determine how ‘safe’ it is. If
the file is an executable that you downloaded from the Internet, this tag will
cause Windows to toss up an “Internet Explorer – Security Warning”
dialog box stating the publisher could not be verified. It will also force
you to click on “Run” in that same dialog box before the program
will execute (as opposed to simply running the program when you run an executable
from a CD). The files you are referring to are not executable, but they
are tagged by IE regardless. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>But don’t take my work for all this –
check out F-secure:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><a
href="http://www.f-secure.com/v-descs/zoneident.shtml">http://www.f-secure.com/v-descs/zoneident.shtml</a><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>. . .and for more painful details,
Microsoft:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><a
href="http://msdn.microsoft.com/workshop/security/szone/reference/objects/PersistentZoneIdentifier.asp">http://msdn.microsoft.com/workshop/security/szone/reference/objects/PersistentZoneIdentifier.asp</a>
<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> -<st1:City
w:st="on"><st1:place w:st="on">Cary</st1:place></st1:City><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><st1:City w:st="on"><st1:place w:st="on"><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'>Cary</span></font></st1:place></st1:City><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> Barker
CISSP, GSEC, GSNA, GCWN, MCSE</span></font><font face="Times New Roman"><span
style='font-family:"Times New Roman"'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Network Security Administrator</span></font><font
face="Times New Roman"><span style='font-family:"Times New Roman"'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Campbell & Company, Inc.</span></font><font
face="Times New Roman"><span style='font-family:"Times New Roman"'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face=SimSun><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>From:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'>
full-disclosure-bounces@lists.grok.org.uk
[mailto:full-disclosure-bounces@lists.grok.org.uk] <b><span style='font-weight:
bold'>On Behalf Of </span></b>Danny NG<br>
<b><span style='font-weight:bold'>Sent:</span></b> Thursday, April 06, 2006
6:42 AM<br>
<b><span style='font-weight:bold'>To:</span></b> full-disclosure@lists.grok.org.uk<br>
<b><span style='font-weight:bold'>Subject:</span></b> [Full-disclosure] Help!</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal><font size=3 face=SimSun><span style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'>Dear all,</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face=SimSun><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'>recently I noticed that my PC shows the
same phenomenon during virus scanning as described below.</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face=SimSun><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'>What I would like to ask is whether it is
a "common" phenomenon, or does it mean a virus (backdoor trojan eg)
attack?</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face=SimSun><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'>I have investigated about ADS and
performed scans using popular scanners such as lns and lads, but it did not
report any problem about the file SHELL32.dll.124.Config. It found
however a lot of ADS, especially for JPG files, giving outputs like xxx.jpg:zone.Identifier</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face=SimSun><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'>I 'm quite worried about the current
situation.</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'>Could somebody help? Thanks!</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face=SimSun><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'>Danny</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face=SimSun><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt;font-family:"Times New Roman"'>
<hr size=2 width="100%" align=center>
</span></font></div>
</div>
<div>
<h1><b><font size=6 face=SimSun><span style='font-size:24.0pt'>[Full-disclosure]
Shell32.dll.124.config<o:p></o:p></span></font></b></h1>
<p class=MsoNormal><b><font size=3 face=SimSun><span style='font-size:12.0pt;
font-weight:bold'>y0himba</span></font></b> <a
href="mailto:full-disclosure%40lists.grok.org.uk?Subject=%5BFull-disclosure%5D%20Shell32.dll.124.config&In-Reply-To=BAY19-DAV10034B5749FF0FE3BCF10ED9A70%40phx.gbl"
title="[Full-disclosure] Shell32.dll.124.config">y0himba at technolounge.org </a><br>
<i><span style='font-style:italic'>Tue Sep 6 03:22:15 BST 2005</span></i> <o:p></o:p></p>
<ul type=disc>
<li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
mso-list:l1 level1 lfo1'><font size=3 face=SimSun><span style='font-size:
12.0pt'>Previous message: <a
href="http://lists.grok.org.uk/pipermail/full-disclosure/2005-September/036828.html">[Full-disclosure]
Shell32.dll.124.config </a><o:p></o:p></span></font></li>
<li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
mso-list:l1 level1 lfo1'><font size=3 face=SimSun><span style='font-size:
12.0pt'>Next message: <a
href="http://lists.grok.org.uk/pipermail/full-disclosure/2005-September/036841.html">[Full-disclosure]
Re: Shell32.dll.124.config </a><o:p></o:p></span></font></li>
<li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
mso-list:l1 level1 lfo1'><b><font size=3 face=SimSun><span
style='font-size:12.0pt;font-weight:bold'>Messages sorted by:</span></font></b>
<a
href="http://lists.grok.org.uk/pipermail/full-disclosure/2005-September/date.html#36829">[
date ]</a> <a
href="http://lists.grok.org.uk/pipermail/full-disclosure/2005-September/thread.html#36829">[
thread ]</a> <a
href="http://lists.grok.org.uk/pipermail/full-disclosure/2005-September/subject.html#36829">[
subject ]</a> <a
href="http://lists.grok.org.uk/pipermail/full-disclosure/2005-September/author.html#36829">[
author ]</a> <o:p></o:p></li>
</ul>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face=SimSun><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center>
</span></font></div>
<pre><font size=3 face=SimSun><span style='font-size:12.0pt'><!--beginarticle--> Thanks for the information. I have sent an email to Mark to see if he can<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>verify this or assist me in any way. This is helpful.<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'><o:p> </o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>-----Original Message-----<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>From: Morning Wood [mailto:<a
href="https://lists.grok.org.uk/mailman/listinfo/full-disclosure">se_cur_ity at hotmail.com</a>] <o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>Sent: Monday, September 05, 2005 10:15 PM<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>To: y0himba; <a
href="https://lists.grok.org.uk/mailman/listinfo/full-disclosure">full-disclosure at lists.grok.org.uk</a><o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>Subject: Re: [Full-disclosure] Shell32.dll.124.config<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'><o:p> </o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>sounds like an ADS ( alternate data stream )<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'><a
href="http://www.sysinternals.com/Utilities/Streams.html">http://www.sysinternals.com/Utilities/Streams.html</a><o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'><o:p> </o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>I wrote this awhile back as notes on a project...<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'><o:p> </o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>this is a simple example...<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>Create an executable ADS:<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>-------------------------<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>c:\>type c:\fullpath\exename.exe > somefile.ext:exename.exe ( or<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>somefile.exe:someothername.exe )<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'><o:p> </o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>Execute an ADS:<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>---------------<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>c:\>start c:\pathto\somefile.ext<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>( starts the example above running exename.exe behind the visible<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>somefile.ext ) c:\>type c:\start.bat > c:\windows\explorer.exe:start.bat (<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>this creates a file named start.bat that executes explorer.exe ) c:\>start (<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>will now execute the full path to c:\to\somefile.ext )<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'><o:p> </o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>hope this helps.<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'><o:p> </o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'><o:p> </o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>----- Original Message -----<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>From: "y0himba" <<a
href="https://lists.grok.org.uk/mailman/listinfo/full-disclosure">y0himba at technolounge.org</a>><o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>To: <<a
href="https://lists.grok.org.uk/mailman/listinfo/full-disclosure">full-disclosure at lists.grok.org.uk</a>><o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>Sent: Monday, September 05, 2005 4:33 PM<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>Subject: [Full-disclosure] Shell32.dll.124.config<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'><o:p> </o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'><o:p> </o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> Hi,<o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> Yes I am a "noob". I have a question though. Google searches and a<o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> few other things can tell me nothing about "shell32.dll.124.config". I am<o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> on WindowsXP SP2, and keep seeing this file show up in antivirus scans,<o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>but<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> cannot find it anywhere on the system! I think it is dynamically created<o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>by<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> something, but after sitting and watching Filemon 7.02 for 20 minutes or<o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>so,<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> I give up. Has anyone heard of this file? Antivir, Bitdefender, AVG and<o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> Clam all show it on the system, have scanned it, but have found nothing.<o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>I<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> have never seen this file before...<o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'><o:p> </o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> Thanks in advance for your help!<o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'><o:p> </o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> -----BEGIN GEEK CODE BLOCK-----<o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> Version: 3.1<o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> GCM/GIT/GO d- s: a C++++$ UL++++ P++++ L++++ E++++ W++++ N+++++ o++++ K++<o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>w<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> O- M- V-- PS+ PE Y++ PGP++ t+ 5-- X+++++ R* tv++ b+++++ DI++ D++++<o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> G++ e h---- r+++ y++++<o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> ------END GEEK CODE BLOCK------<o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> Get Your Geek Code: <a
href="http://www.geekcode.com/">http://www.geekcode.com</a><o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'><o:p> </o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> -- <o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> No virus found in this outgoing message.<o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> Checked by AVG Anti-Virus.<o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> Version: 7.0.344 / Virus Database: 267.10.18/90 - Release Date: 9/5/2005<o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'><o:p> </o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'><o:p> </o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> _______________________________________________<o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> Full-Disclosure - We believe in it.<o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> Charter: <a
href="http://lists.grok.org.uk/full-disclosure-charter.html">http://lists.grok.org.uk/full-disclosure-charter.html</a><o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'> Hosted and sponsored by Secunia - <a
href="http://secunia.com/">http://secunia.com/</a><o:p></o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>><i><span
style='font-style:italic'><o:p> </o:p></span></i></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'><o:p> </o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>-- <o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>No virus found in this incoming message.<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>Checked by AVG Anti-Virus.<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>Version: 7.0.344 / Virus Database: 267.10.18/90 - Release Date: 9/5/2005<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'> <o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'><o:p> </o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>-- <o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>No virus found in this outgoing message.<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>Checked by AVG Anti-Virus.<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'>Version: 7.0.344 / Virus Database: 267.10.18/90 - Release Date: 9/5/2005<o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'> <o:p></o:p></span></font></pre><pre><font
size=3 face=SimSun><span style='font-size:12.0pt'><o:p> </o:p></span></font></pre><!--endarticle-->
<div class=MsoNormal align=center style='text-align:center'><font size=3
face=SimSun><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center>
</span></font></div>
<font size=3 face=SimSun><span style='font-size:12.0pt;font-family:SimSun'>
<ul type=disc>
<!--threads-->
<li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
mso-list:l0 level1 lfo2'>Previous message: <a
href="http://lists.grok.org.uk/pipermail/full-disclosure/2005-September/036828.html">[Full-disclosure]
Shell32.dll.124.config </a><o:p></o:p></li>
<li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
mso-list:l0 level1 lfo2'>Next message: <a
href="http://lists.grok.org.uk/pipermail/full-disclosure/2005-September/036841.html">[Full-disclosure]
Re: Shell32.dll.124.config </a><o:p></o:p></li>
<li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
mso-list:l0 level1 lfo2'><b><span style='font-weight:bold'>Messages sorted
by:</span></b> <a
href="http://lists.grok.org.uk/pipermail/full-disclosure/2005-September/date.html#36829">[
date ]</a> <a
href="http://lists.grok.org.uk/pipermail/full-disclosure/2005-September/thread.html#36829">[
thread ]</a> <a
href="http://lists.grok.org.uk/pipermail/full-disclosure/2005-September/subject.html#36829">[
subject ]</a> <a
href="http://lists.grok.org.uk/pipermail/full-disclosure/2005-September/author.html#36829">[
author ]</a> <o:p></o:p></li>
</ul>
</span></font>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face=SimSun><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center>
</span></font></div>
<p class=MsoNormal><font size=3 face=SimSun><span style='font-size:12.0pt'><a
href="https://lists.grok.org.uk/mailman/listinfo/full-disclosure">Full-Disclosure</a>
is hosted and sponsored by <a href="http://secunia.com/">Secunia</a>.<o:p></o:p></span></font></p>
</div>
<p class=MsoNormal><font size=3 face=SimSun><span style='font-size:12.0pt'><br>
______________________________________________________________________<br>
This email has been scanned by the MessageLabs Email Security System.<br>
For more information please visit http://www.messagelabs.com/email <br>
______________________________________________________________________<o:p></o:p></span></font></p>
</div>
<BR>
______________________________________________________________________<BR>
Campbell & Company, Inc.: The information in this e-mail may contain privileged/confidential information. If you are not the intended recipient, you must not read, use, copy or disseminate the information or take any action in reliance thereupon. If you have received this e-mail in error, please notify Campbell & Company, Inc. immediately by e-mail or telephone and delete the e-mail and any attachments from any computer. The information in this e-mail does not constitute an offer to sell or the solicitation of an offer to buy any securities in any jurisdiction or for the benefit of any person. <BR>
______________________________________________________________________<BR>
This email has been scanned by the MessageLabs Email Security System.<BR>
For more information please visit http://www.messagelabs.com/email <BR>
______________________________________________________________________<BR>
</body>
</html>