[Dshield] looks like a new virus via spaming

William Mathews billm at wizardsecurity.net
Tue Aug 19 18:21:19 GMT 2003


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I'm seeing the same thing. Pretty annoying.

- -----Original Message-----
From: list-bounces at dshield.org [mailto:list-bounces at dshield.org]On
Behalf Of Dan
Sent: Tuesday, August 19, 2003 1:32 PM
To: General DShield Discussion List
Subject: Re: [Dshield] looks like a new virus via spaming


Hello all,
Well I just got mail bombed with some new virus (at least that was my
bet)called movie0045.pif.  It was all deleted before it reached my machine
(mail washer).  The subjects vary between Your details, that movie,
approved, thank you!, or wicked screen saver.  They appear to come from
various sources, but I suspect that it is all the same spamer just using
various different paths open to him as they all came in to the same email
address at only a few minutes/seconds appart.

Just wondering if anyone else has seen this.

Oh I forgot to mention about 30 of these hit my mailbox so far and still
comming.  And it looks like some of them used my email as a return address
as I got a message from one of them:

"The mail message you sent to (*******************) on 08/19/2003 11:27:38
with the file wicked_scr.scr contains the WORM_SOBIG.F virus. If you have
questions regarding files or updating/installing Anti-virus protection on
your PC, please contact your e-mail administrator or help desk."

So it appears that the ones named "wicked screen saver" did have the sobig
virus.  And I bet that the rest of them did as well.


- -Dan

_______________________________________________
list mailing list
list at dshield.org
To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQA/AwUBP0JqnyhI4wZUZO+UEQIt5QCg9CWo+ho2Guie2HcXd0zkr8xGctYAniFT
Yo9xJyU5shbLSA1Q5J+JhVAO
=thgI
-----END PGP SIGNATURE-----




More information about the list mailing list