It does not however have the same behavior as the one listed at http://www.f-secure.com/v-descs/lovelorn.shtml
In particular it differs here:
The "From" address of these e-mails are always set to be one of the following addresses: '[EMAIL PROTECTED]', '[EMAIL PROTECTED]' or '[EMAIL PROTECTED]'.
The mail I recieved was from my own email address so there may be a variant that spoofs the from address.
-KF
LaRose, Dallas wrote:
Google search: http://www.google.com/search?hl=en&lr=&ie=UTF-8&oe=UTF-8&q=%2B%22Tinh%60+cho +khong+bieu%27+khong%22+%2Bvirus
Take the first hit and then search on a US virus site: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_LOVELOR N.A
Does this look familiar?
-----Original Message-----
From: KF [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 27, 2003 7:09 AM
To: [EMAIL PROTECTED]
Subject: [Full-Disclosure] new virii? - Tinh` cho khong bieu' khong
is anyone familiar with a win32 based virus with the following text in the email message?
</script><html>Tinh` cho khong bieu' khong</html>
It appears to drop a file named "temp.exe"
if anyone wants the .html I can send it your way... -KF
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
