I will second this once again, I submitted this to Mcafee and the extra.dat
file I got mentioned W32/[EMAIL PROTECTED]
I haven't received anything back from them since about 1/2 hour ago. So for
the .exe name has changed on the ones we have seen.
Here is an example from one of the messages we have received -
To: [EMAIL PROTECTED]
Subject: ID ulkkhfrbtr... thanks
From: [EMAIL PROTECTED]
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="--------552752223023604"
X-Declude-Sender: [EMAIL PROTECTED] [80.146.90.39]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: None [0]
X-Note: This E-mail was sent from ([80.146.90.39]).
X-Note: Total spam weight of this E-mail is 0
----------552752223023604
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Yours ID pysemjfq
--
Thank
----------552752223023604
Content-Type: application/x-msdownload; name="abuj.exe"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="jmbfsarpnpk.exe"
----- Original Message -----
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, February 17, 2004 9:01 AM
Subject: [Declude.Virus] New virus Tanx
Don
> FYI, there is a new virus that was discovered several hours ago, and we've
> already seen several copies come in here. Details are at
> http://www.sophos.com/virusinfo/analyses/w32tanxa.html .
>
> -Scott
> ---
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
