McAfee calls it: MultiDropper-IY an Extra.dat is available.
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Friday, January 28, 2005 04:39 PM To: Declude.Virus@declude.com Subject: [Declude.Virus] Foto.rar Another variation - came with a "foto.rar" attachment. Received: from host46.ipowerweb.com [66.235.216.140] by hm-software.com (SMTPD32-8.14) id A70B620D0124; Fri, 28 Jan 2005 14:48:27 -0500 Received: from riqotscr (168.113.230.53) by host46.ipowerweb.com; Fri, 28 Jan 2005 11:48:22 -0800 Message-ID: <[EMAIL PROTECTED]> Reply-To: <[EMAIL PROTECTED]> From: <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: photo Date: Fri, 28 Jan 2005 11:48:22 -0800 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_0091_01C4F282.E483B826" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1158 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-Declude: Version 1.82; D970a620d01240fca.SMD from host46.ipowerweb.com [66.235.216.140] X-Declude: Triggered [0] WEIGHTSNIFFER X-Countries: UNITED STATES->[ARIN Unlisted]->destination Return-Path: <[EMAIL PROTECTED]> X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 406759401 Hi Pete! My porn photo, only for you ;) With love, Alice. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
