What Is This?

Malware appeared on my floppy whilst uploading to FQ yesterday

[Angonasec]

I was shocked to see the following folders and files on my floppy disc today. I didn't put them there and I have no toolbars or junkware on my computer. I last used the disk to upload files to my website on a Win98 'puter. I use the free Agnitum firewall, and the only dodgy sites I visit, are suspicious ones showing in my logs. The latest was: www.atelebanon.com which may or may not having anything to do with this.

Here's the tree I saw on the floppy, none of the folders or files could be opened with an editor, and their properties were spurious. ie. massive GB files and dates set decades in the future

Folder: h my roo.t h
Folder: ood guy'.a

file: the MSI.ECr
file: .1" 403.306
file: .1; sv1;. .n
file: 2-05003]. "9
file: 6.78.90.--
file: ill conf.use
file: locking.cod

An updated Norton AV scan over it came up clean but I also noticed another file name appear in that scan:
/ovement.in

Updated Spybot scan also showed clean

I also have a Linux computer, but I think these files got on the disk whilst I was using the Win box, I'm not certain.

What is it? Where did it come from? How do I stop it happening?

Possibly connected: In another thread here, I'm asking how to stop my .htaccess code from banning MSIECrawler visitors, who currently get a 403 despite nothing in my .htaccess code causing this. I mention it becasue of the file names in the malware: file: the MSI.ECr and file: .1" 403.306

[Dreamquick]

Could of course just be a corrupted floppy disk which is mis-reporting its contents (hence the weird dates and incorrect file sizes).

Try getting windows to scan the disk fully for errors.

- Tony

[Angonasec]

You may be onto something there Tony, I'll do that after I get off this Linux box.

Having a look at those file names again, if you join them all together they could look like 'out-takes' from a text file I used to make my other recent WebmasterWorld post about unblocking MSIECrawler.

'Praps the floppy scrunged the lot together, and printed this on itself. It's currently tossed in a corner where my cat is playing with it.

Ta!