> Actually, it was broken in the version I received:
>
> ------=_NextPart_000_0022_018E23CD.0E23CD90
> Content-Type: application/octet-stream; name="~GL_3679.EXE"
> Content-Transfer-Encoding: base64
> Content-Disposition: attachment; filename="~GL_3679.EXE"
>
> TVqQAAMAAAAEAAAA [...]
>
> Where can I get a good copy?
I dont think you got a broken copy, but just two separate files.
The first one was the virus, the second one was a piece of an
encoded Word.doc file, from which a snippet had been copied into
the 'Subject' line, at least that was what I received. I just
didn't mention the Word.doc, because it was boring.
If you want a 'live', unencrypted version, I can send you one, no
problemo. You can run it through a disassembler and probably get
a clue as to what the writer was doing, with plenty of errors,
probably, since I understand that disassembly is an imperfect
operation.
-wittig http://www.robertwittig.com/
To unsubscribe from SURVPC send a message to [EMAIL PROTECTED] with
unsubscribe SURVPC in the body of the message.
Also, trim this footer from any quoted replies.
More info can be found at;
http://www.softcon.com/archives/SURVPC.html
