The Viruswriter seems to be from Germany The string [EMAIL PROTECTED] AdmSkynetJklS003 can be found inside the virus code the IP 217.5.100.1 is a dial up from the german Telekom: DTAG-DIAL13 one of the attatchment names refers to a german explicit "movie star"
Nothing new as I can see, packed with upx, UDP packet sender, SMTP Routine, tries to install itself as a service, tries to infect network shares and file sharing ... business as usual. the only not so harmless function is: Kernel32.DeleteFilaA Helmut _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
