[Dshield] looks like a new virus via spaming

William Mathews billm at wizardsecurity.net
Tue Aug 19 18:21:19 GMT 2003

Hash: SHA1

I'm seeing the same thing. Pretty annoying.

- -----Original Message-----
From: list-bounces at dshield.org [mailto:list-bounces at dshield.org]On
Behalf Of Dan
Sent: Tuesday, August 19, 2003 1:32 PM
To: General DShield Discussion List
Subject: Re: [Dshield] looks like a new virus via spaming

Hello all,
Well I just got mail bombed with some new virus (at least that was my
bet)called movie0045.pif.  It was all deleted before it reached my machine
(mail washer).  The subjects vary between Your details, that movie,
approved, thank you!, or wicked screen saver.  They appear to come from
various sources, but I suspect that it is all the same spamer just using
various different paths open to him as they all came in to the same email
address at only a few minutes/seconds appart.

Just wondering if anyone else has seen this.

Oh I forgot to mention about 30 of these hit my mailbox so far and still
comming.  And it looks like some of them used my email as a return address
as I got a message from one of them:

"The mail message you sent to (*******************) on 08/19/2003 11:27:38
with the file wicked_scr.scr contains the WORM_SOBIG.F virus. If you have
questions regarding files or updating/installing Anti-virus protection on
your PC, please contact your e-mail administrator or help desk."

So it appears that the ones named "wicked screen saver" did have the sobig
virus.  And I bet that the rest of them did as well.

- -Dan

list mailing list
list at dshield.org
To change your subscription options (or unsubscribe), see:
Version: PGP 8.0


More information about the list mailing list