Sad to say, my virus checker has today identified the BVE LUL Circle Line .exe as containing the IRC/Backdoor.SdBot Trojan. McAfee has the following to say about it:
A new variant of this threat has been seen in a large number of email messages. This variant is detected with the 4249 DAT files (and higher) and 4.2.40 engine as IRC-Sdbot. AVERT has received a handful of samples of this variant. When this trojan receives the appropriate command, via IRC, it attempts to SPAM itself using the following email message (note: this is not worm functionality as someone must manually send a mailing command to all of the IRC-Sdbot drones):
Subject: Hi, I sent you an eCard from BlueMountain.com
Body: To view your eCard, open the attachment
If you have any comments or questions, please visit http://www.bluemountain.com/customer/index.pd
John
Thanks for using BlueMountain.com.
Attachment: BlueMountaineCard.pif
When the attachment is run, the virus infects the local system. It copies itself to the WINDOWS SYSTEM (%SysDir%) directory as iexplorer.exe and creates a registry run key to load the worm at startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\
Run "sysconfig" = iexplorer.exe
The threat is identified as 'Low' - still, do keep those virus-checkers up to date!
A new variant of this threat has been seen in a large number of email messages. This variant is detected with the 4249 DAT files (and higher) and 4.2.40 engine as IRC-Sdbot. AVERT has received a handful of samples of this variant. When this trojan receives the appropriate command, via IRC, it attempts to SPAM itself using the following email message (note: this is not worm functionality as someone must manually send a mailing command to all of the IRC-Sdbot drones):
Subject: Hi, I sent you an eCard from BlueMountain.com
Body: To view your eCard, open the attachment
If you have any comments or questions, please visit http://www.bluemountain.com/customer/index.pd
John
Thanks for using BlueMountain.com.
Attachment: BlueMountaineCard.pif
When the attachment is run, the virus infects the local system. It copies itself to the WINDOWS SYSTEM (%SysDir%) directory as iexplorer.exe and creates a registry run key to load the worm at startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\
Run "sysconfig" = iexplorer.exe
The threat is identified as 'Low' - still, do keep those virus-checkers up to date!
If the file passes I'll update
Comment