-Caveat Lector- Yes, it's new one..here's some info: > DESCRIPTON: > > I-Worm/Apost > ------------ > > It is a new mass mailing worm written in Visual Basic. > > The worm is spreading as a file README.EXE in messages with the > subject: > > As per your request! > > and the body: > > Please find attached file for your review. > I look forward to hear from you again very soon. > Thank you. > > When is the README.EXE file is executed it copies itself into Windows > directory and create in the registry key: > > HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run > > a value named "macrosoft" pointing to the dropped copy of the worm. > > Then the worm takes email addresses from Outlook address book > and starts sending itself. > > Next, it displays a message box with a button 'Open'. When > you click on it, a fake error message appears: > > WinZip SelfExtractor: Warning > CRC eror: 234#21 ----- Original Message ----- From: "Ole Gerstr�m" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: [CTRL] Birgenair - this looks like a virus, dont open > -Caveat Lector- > > ----- Original Message ----- > From: John Miller <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Thursday, September 06, 2001 10:24 AM > Subject: [CTRL] Birgenair > > > Hi! How are you? > > I send you this file in order to have your advice > > See you later. Thanks <A HREF="http://www.ctrl.org/";>www.ctrl.org</A> DECLARATION & DISCLAIMER ========== CTRL is a discussion & informational exchange list. Proselytizing propagandic screeds are unwelcomed. Substance�not soap-boxing�please! These are sordid matters and 'conspiracy theory'�with its many half-truths, mis- directions and outright frauds�is used politically by different groups with major and minor effects spread throughout the spectrum of time and thought. That being said, CTRLgives no endorsement to the validity of posts, and always suggests to readers; be wary of what you read. CTRL gives no credence to Holocaust denial and nazi's need not apply. Let us please be civil and as always, Caveat Lector. ======================================================================== Archives Available at: http://peach.ease.lsoft.com/archives/ctrl.html <A HREF="http://peach.ease.lsoft.com/archives/ctrl.html";>Archives of [EMAIL PROTECTED]</A> http:[EMAIL PROTECTED]/ <A HREF="http:[EMAIL PROTECTED]/";>ctrl</A> ======================================================================== To subscribe to Conspiracy Theory Research List[CTRL] send email: SUBSCRIBE CTRL [to:] [EMAIL PROTECTED] To UNsubscribe to Conspiracy Theory Research List[CTRL] send email: SIGNOFF CTRL [to:] [EMAIL PROTECTED] Om
