I just threw it into a hex editor and discovered it is the
ShellScrapWorm by SimpleSimon, It first appeared
yesterday on a Firewall List and I'm sure the other
Linux list are the next targets this jerk will send it to.
Scott Faulkner
[EMAIL PROTECTED]
> Warning to ALL on linux_net
> This message threw up a VIRUS alert in our system.
>
> >>From: Robert Barnes <[EMAIL PROTECTED]>
> >>Subject: Fw: Life stages
> >>Date: Thu, 22 Jun 2000 09:41:24 +1000
>
>
> Looking at the code, it DOES appear to search through AddressBook Entries...
>
> >> For VH=1 To G.AddressEntries.Count
> >> Set FP=G.AddressEntries(VH)
> >> If VH=1 Then U.BCC=FP.Address Else U.BCC=U.BCC&D("< ")&FP.Address
> >> Next
>
> The message came through the linux-net path from
> Robert Barnes <[EMAIL PROTECTED]>
> Path is shown below
> ---------------------
> Return-Path: <[EMAIL PROTECTED]>
> Received: from nic.funet.fi (nic.funet.fi [193.166.0.145])
> by ns.ecomrenaissance.com (8.9.3/8.9.3/SuSE Linux 8.9.3-0.1) with
> ESMTP id KAA15789
> for <[EMAIL PROTECTED]>; Thu, 22 Jun 2000 10:38:46 +1000
> Received: from vger.rutgers.edu ([128.6.190.2]:27861 "EHLO vger.rutgers.edu"
> ident: "NO-IDENT-SERVICE[2]" smtp-auth: <none> TLS-CIPHER: <none>)
> by nic.funet.fi with ESMTP id <S7481AbQFVAh3>;
> Thu, 22 Jun 2000 03:37:29 +0300
> Received: ([EMAIL PROTECTED]) by vger.rutgers.edu via listexpand
> id <S157292AbQFUXkg>; Wed, 21 Jun 2000 19:40:36 -0400
> Received: by vger.rutgers.edu id <S157250AbQFUXk1>;
> Wed, 21 Jun 2000 19:40:27 -0400
> Received: from [203.102.220.26] ([203.102.220.26]:1615 "EHLO
> mail.nulec.com.au")
> by vger.rutgers.edu with ESMTP id <S157272AbQFUXjz>;
> Wed, 21 Jun 2000 19:39:55 -0400
> Received: by MAIL with Internet Mail Service (5.5.2650.21)
> id <NMGQY57Y>; Thu, 22 Jun 2000 09:41:26 +1000
> Message-ID: <1072F1A27E99D3119747005004B9A380668583@MAIL>
> From: Robert Barnes <[EMAIL PROTECTED]>
> Subject: Fw: Life stages
> Date: Thu, 22 Jun 2000 09:41:24 +1000
> MIME-Version: 1.0
> X-Mailer: Internet Mail Service (5.5.2650.21)
> Content-Type: multipart/mixed;
> boundary="----_=_NextPart_000_01BFDBDA.36ABB0ED"
> To: unlisted-recipients:; (no To-header on input)
> Sender: [EMAIL PROTECTED]
> Precedence: bulk
> X-Loop: [EMAIL PROTECTED]
> X-UIDL: 23a987b19aefc34b1cc95b13ac3ea961
>
> > The male and female stages of life.
>
>
> Content-Type: application/octet-stream;
> name="LIFE_STAGES.TXT.SHS"
> Content-Disposition: attachment;
> filename="LIFE_STAGES.TXT.SHS"
> -----------------------------------------------------------------------------
> >> The male and female stages of life.
> >
> >
> >Content-Type: application/octet-stream;
> > name="LIFE_STAGES.TXT.SHS"
> >Content-Disposition: attachment;
> > filename="LIFE_STAGES.TXT.SHS"
> >
> >Attachment converted: :LIFE_STAGES.TXT.SHS (????/----) (000B8227)
>
>
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-net" in
> the body of a message to [EMAIL PROTECTED]
-
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to [EMAIL PROTECTED]
