------------------------------------------------------------
** VIRUS ADVISORY - W32/[EMAIL PROTECTED] **
------------------------------------------------------------
A new variant of W32/Sobig, W32/[EMAIL PROTECTED] is a High Risk
mass-mailing worm. It arrives as an email attachment with
a .pif or .scr extension. When run, it infects the host
computer, then emails itself (using its own SMTP engine)
to harvested email addresses from the victim's machine.
In addition, when it propagates, the worm "spoofs" the
"from: field", using one of the harvested email addresses.
Note: The worm copies itself onto the infected machine as:
C:\WINNT\WINPPR32.EXE
Caution: An infected email can come from addresses you
recognize and may contain the following information:
Subject:
- Your details
- Thank you!
- Re: Thank you!
- Re: Details
- Re: Re: My details
- Re: Approved
- Re: Your application
- Re: Wicked screensaver
- Re: That movie
Attachment:
- your_document.pif
- document_all.pif
- thank_you.pif
- your_details.pif
- details.pif
- document_9446.pif
- application.pif
- wicked_scr.scr
- movie0045.pif
Body:
- See the attached file for details
- Please see the attached file for details
Current and up-to-date VirusScan users are protected from
this threat.
Learn more about W32/[EMAIL PROTECTED]:
==> http://us.mcafee.com/root/campaign.asp?cid=8449
Scan for W32/[EMAIL PROTECTED]:
==> http://us.mcafee.com/root/campaign.asp?cid=8450
---
[This E-mail Scanned For Viruses By Declude Virus Scanner]
[This E-mail Scanned For Spam By Declude JunkMail]
---
[This E-mail scanned for viruses by Declude Virus on the server aea8.k12.ia.us]
---------------------------------------------------------
Archived messages from this list can be found at:
http://www.mail-archive.com/[EMAIL PROTECTED]/
---------------------------------------------------------
