Well that's a new trick

Article View: sci.astro

Article #3987

#3987

From: Bluuuue Rajah
Date: Fri, 19 Dec 2008 15:57

11 lines
2235 bytes

I just tried to download Darlele Love's excellent Christmas song, "All 
Alone This Christmas," with Limewire, and was surprised when it tried to 
install a virus on my PC.  Normally I'm quite adept at distinguishing the 
thinl disguised viri from the useful content, but this time the malware 
designers fooled me.  They managed to make the file lok like it had the 
correct length for a three minute pop song, and they managed to translate 
my search string "nobody alone christmas" into "Darlene Love - All Alone 
This Chritsmas."  I wonder how they did that, and what I should do (besides 
the obvious of keeping my AV s/w current) to identify the disguised 
viruses, when I'm downloading with P2P music.

Technical Details

Message-ID: <Xns9B79703B96735fdgdfjhsrtg@207.115.17.102>

Path:

arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!news2.google.com!newsfeed.stanford.edu!headwall.stanford.edu!newshub.sdsu.edu!flph200.ffdc.sbc.com!prodigy.net!flph199.ffdc.sbc.com!prodigy.com!flpi107.ffdc.sbc.com!flpi146.ffdc.sbc.com.POSTED!50653037!not-for-mail

Show Full Headers

Complete Article Headers

X-Google-Thread: f74ae,e75017b9cb0937d2,start
X-Google-Thread: 109d8a,e75017b9cb0937d2,start
X-Google-Thread: 10bb54,e75017b9cb0937d2,start
X-Google-Thread: 1050a2,e75017b9cb0937d2,start
X-Google-Thread: faa3c,e75017b9cb0937d2,start
X-Google-Attributes: gidf74ae,gid109d8a,gid10bb54,gid1050a2,gidfaa3c,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!news2.google.com!newsfeed.stanford.edu!headwall.stanford.edu!newshub.sdsu.edu!flph200.ffdc.sbc.com!prodigy.net!flph199.ffdc.sbc.com!prodigy.com!flpi107.ffdc.sbc.com!flpi146.ffdc.sbc.com.POSTED!50653037!not-for-mail
Newsgroups: sci.astro,sci.math,alt.2600,microsoft.public.windowsxp.help_and_support,24hoursupport.helpdesk
Subject: Well that's a new trick
From: Bluuuue Rajah <Bluuuuue@Rajah.>
Message-ID: <Xns9B79703B96735fdgdfjhsrtg@207.115.17.102>
Followup-To: sci.astro,sci.math,alt.2600,microsoft.public.windowsxp.help_and_support,24hoursupport.helpdesk
User-Agent: Xnews/5.04.25
Lines: 11
NNTP-Posting-Host: 99.130.64.177
X-Complaints-To: abuse@prodigy.net
X-Trace: flpi146.ffdc.sbc.com 1229702242 ST000 99.130.64.177 (Fri, 19 Dec 2008 10:57:22 EST)
NNTP-Posting-Date: Fri, 19 Dec 2008 10:57:22 EST
Organization: at&t http://my.att.net/
X-UserInfo1: [[PAPDCAOPTUSWHX[BNR_TXAPZXFBL@MAHU^_BAMEH]TCDYG^WH[AKK[J\]^HVKHG^EWZHBLO^[\NH_AZFWGN^\DHNVMX_DHHX[FSQKBOTS@@BP^]C@RHS_AGDDC[AJM_T[GZNRNZAY]GNCPBDYKOLK^_CZFWPGHZIXW@C[AFKBBQS@E@DAZ]VDFUNTQQ]FN
Date: Fri, 19 Dec 2008 15:57:22 GMT