Follow The Bouncing Malware: Gone With the WINS

They do. But don't try it. Really. This means you. Yes you. Don't look at me like that. You know that you're just sitting there, fighting the urge to go try it-- acting all nonchalant, like you don't care. It's slowly eating away at you. We both know that you're trying to think of something... anything else... just to keep your mind off of wanting to rip the nearest USB cable out its jack so you can go check to see if I'm telling you the truth. But I am. I am. Would I lie to you?

It Happened One Night

At this point in most of the other FTBM postings, I would-- in a rare display of lucidity--take a moment to step aside from my normally disjointed prose to warn you, my dear reader, of the perils of embarking on any attempt to "play around" with the malicious code we're about to examine. Having discovered, over these many years, that none of you actually pay one damn bit of attention to what I say, I've decided to say "t'hell with it..." Have fun! Launch the malware! Run with scissors! Play with matches! Swim right after eating! Don't wear clean underwear, you'll never be in an accident! Your mother was WRONG!

Read the full article
http://isc.sans.org/diary.html?storyid=6349

Archives

For those that have not yet read the FTBM series, below are links to each edition.

FTBM - Part I - http://isc.sans.org/diary.php?date=2004-07-23
FTBM - Part II - http://isc.sans.org/diary.php?date=2004-08-23
FTBM - Part III - http://isc.sans.org/diary.php?date=2004-11-04
FTBM - Part IV - http://isc.sans.org/diary.php?date=2004-11-24
FTBM - Part V - http://isc.sans.org/diary.php?date=2005-05-11
FTBM - Part VI - http://isc.sans.org/diary.php?date=2005-07-13
FTBM - Part VII - http://isc.sans.org/diary.php?date=2005-07-20
FTBM - Part VIII - http://isc.sans.org/diary.php?date=2005-08-22
FTBM - Part IX - http://isc.sans.org/diary.php?date=2005-09-21
FTBM - Part IX - http://isc.sans.org/diary.html?storyid=2682
FTBM - Part XI - http://isc.sans.org/diary.html?storyid=6349

Tom's website
http://www.intelguardians.com

The Tom Liston Fanclub
http://mysteryfcm.co.uk/?mode=News&date=22-07-2005