[Dshield] A new Netsky variant ?

Andreas Maus maus at ypbind.de
Fri May 11 16:24:42 GMT 2007

Hi list.

As I can see the attachment was stripped by the list
server. If you are interested in this sample yo can
fetch it from:


This file contains the attachment (your_document.doc.pif)
and the complete email that contains the file.

Obviously the password for the ZIP archive is "infected" ;)


"Things that try to look like things often do
 look more like things than things. Well-known fact."
Granny Weatherwax - "Wyrd sisters"
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.sans.org/pipermail/list/attachments/20070511/bfe49491/attachment.bin 

More information about the list mailing list