From: Matthias Hoys
Subject: Re: hotmail password request tool (intranet usage)
Date: Mon, 18 Apr 2005 14:27:11 +0000
Message-ID: <4263c3c1$0$15476$ba620e4c@news.skynet.be>

<··············@hotmail.com> wrote in message 
·····························@f14g2000cwb.googlegroups.com...
>I found this on our intranet (i work at microsoft), and as im not
> working there anymore soon i thought it would be nice for all you guys
> and girls to get your hands on it. Ive put it on
> http://matweb.info/~hotmail/hotmail.rar
>
> Have fun!
>

Is it a virus or a Trojan Horse ? What does it do exactly ? 

From: bernard tatin
Subject: Re: hotmail password request tool (intranet usage)
Date: Mon, 18 Apr 2005 15:40:21 +0000
Message-ID: <byQ8e.46951$Of5.30978@nntpserver.swip.net>

Matthias Hoys wrote:
> <··············@hotmail.com> wrote in message 
> ·····························@f14g2000cwb.googlegroups.com...
> 
>>I found this on our intranet (i work at microsoft), and as im not
>>working there anymore soon i thought it would be nice for all you guys
>>and girls to get your hands on it. Ive put it on
>>http://matweb.info/~hotmail/hotmail.rar
>>
>>Have fun!
>>
> 
> 
> Is it a virus or a Trojan Horse ? What does it do exactly ? 
> 
> 

My eMac cannot run it, so I cannot tell you.

I open it with Emacs and it contains this :

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1"manifestVersion="1.0">
<assemblyIdentity
     type="win32"
     processorArchitecture="*"
     version="6.0.0.0"
     name="mash"
/>

<description>AutoIt 3</description>
<dependency>
     <dependentAssembly>
         <assemblyIdentity
             type="win32"
             name="Microsoft.Windows.Common-Controls"
             version="6.0.0.0"
             language="*"
             processorArchitecture="*"
	    publicKeyToken="6595b64144ccf1df"
         />
    </dependentAssembly>
</dependency>
</assembly>

I like the text - i work at microsoft ...

Bernard