The most strange thing is, the ending .shs is not visible, if you put this
file on the desktop. And you can't change the file type until you will
change it on a unix box. (god thanks for unix) What kind of MS bullshit is
this .shs?
Thomas
----- Original Message -----
From: Scott Faulkner <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, June 22, 2000 3:48 AM
Subject: Re: WARNING - Possible Virus Re: Fw: Life stages
>
> I just threw it into a hex editor and discovered it is the
> ShellScrapWorm by SimpleSimon, It first appeared
> yesterday on a Firewall List and I'm sure the other
> Linux list are the next targets this jerk will send it to.
>
>
> Scott Faulkner
> [EMAIL PROTECTED]
>
>
>
> > Warning to ALL on linux_net
> > This message threw up a VIRUS alert in our system.
> >
> > >>From: Robert Barnes <[EMAIL PROTECTED]>
> > >>Subject: Fw: Life stages
> > >>Date: Thu, 22 Jun 2000 09:41:24 +1000
> >
> >
> > Looking at the code, it DOES appear to search through AddressBook
Entries...
> >
> > >> For VH=1 To G.AddressEntries.Count
> > >> Set FP=G.AddressEntries(VH)
> > >> If VH=1 Then U.BCC=FP.Address Else U.BCC=U.BCC&D("< ")&FP.Address
> > >> Next
> >
> > The message came through the linux-net path from
> > Robert Barnes <[EMAIL PROTECTED]>
> > Path is shown below
> > ---------------------
> > Return-Path: <[EMAIL PROTECTED]>
> > Received: from nic.funet.fi (nic.funet.fi [193.166.0.145])
> > by ns.ecomrenaissance.com (8.9.3/8.9.3/SuSE Linux 8.9.3-0.1) with
> > ESMTP id KAA15789
> > for <[EMAIL PROTECTED]>; Thu, 22 Jun 2000 10:38:46 +1000
> > Received: from vger.rutgers.edu ([128.6.190.2]:27861 "EHLO
vger.rutgers.edu"
> > ident: "NO-IDENT-SERVICE[2]" smtp-auth: <none> TLS-CIPHER: <none>)
> > by nic.funet.fi with ESMTP id <S7481AbQFVAh3>;
> > Thu, 22 Jun 2000 03:37:29 +0300
> > Received: ([EMAIL PROTECTED]) by vger.rutgers.edu via
listexpand
> > id <S157292AbQFUXkg>; Wed, 21 Jun 2000 19:40:36 -0400
> > Received: by vger.rutgers.edu id <S157250AbQFUXk1>;
> > Wed, 21 Jun 2000 19:40:27 -0400
> > Received: from [203.102.220.26] ([203.102.220.26]:1615 "EHLO
> > mail.nulec.com.au")
> > by vger.rutgers.edu with ESMTP id <S157272AbQFUXjz>;
> > Wed, 21 Jun 2000 19:39:55 -0400
> > Received: by MAIL with Internet Mail Service (5.5.2650.21)
> > id <NMGQY57Y>; Thu, 22 Jun 2000 09:41:26 +1000
> > Message-ID: <1072F1A27E99D3119747005004B9A380668583@MAIL>
> > From: Robert Barnes <[EMAIL PROTECTED]>
> > Subject: Fw: Life stages
> > Date: Thu, 22 Jun 2000 09:41:24 +1000
> > MIME-Version: 1.0
> > X-Mailer: Internet Mail Service (5.5.2650.21)
> > Content-Type: multipart/mixed;
> > boundary="----_=_NextPart_000_01BFDBDA.36ABB0ED"
> > To: unlisted-recipients:; (no To-header on input)
> > Sender: [EMAIL PROTECTED]
> > Precedence: bulk
> > X-Loop: [EMAIL PROTECTED]
> > X-UIDL: 23a987b19aefc34b1cc95b13ac3ea961
> >
> > > The male and female stages of life.
> >
> >
> > Content-Type: application/octet-stream;
> > name="LIFE_STAGES.TXT.SHS"
> > Content-Disposition: attachment;
> > filename="LIFE_STAGES.TXT.SHS"
>
> --------------------------------------------------------------------------
---
> > >> The male and female stages of life.
> > >
> > >
> > >Content-Type: application/octet-stream;
> > > name="LIFE_STAGES.TXT.SHS"
> > >Content-Disposition: attachment;
> > > filename="LIFE_STAGES.TXT.SHS"
> > >
> > >Attachment converted: :LIFE_STAGES.TXT.SHS (????/----) (000B8227)
> >
> >
> >
> > -
> > To unsubscribe from this list: send the line "unsubscribe linux-net" in
> > the body of a message to [EMAIL PROTECTED]
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-net" in
> the body of a message to [EMAIL PROTECTED]
>
-
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to [EMAIL PROTECTED]
