G
Gabriele Neukam
Just FYI. I got two infected mails of Dumaru.J (named by Kaspersky) from
German users. One is a technical high school (dang)
The content looks like this:
Return-Path: <[email protected]>
Received: from localhost ([141.7.42.34]) by mailin00.sul.t-online.de
with esmtp id 1AkGLz-1Z9UJc0; Sat, 24 Jan 2004 06:29:07 +0100
From: "Elene" <****[email protected]>
To: <[email protected]>
Subject: Important information for you. Read it immediately !
MIME-Version: 1.0
X-Seen: false
X-TOI-SPAM: n;0;2004-01-24T05:29:26Z
X-Mailer: T-Online eMail 4.111
Content-Type: multipart/mixed;boundary="xxxx"
Date: 24 Jan 2004 15:20 GMT
--xxxx
Content-Type: text/html;
Content-Transfer-Encoding: 7bit
<FONT color=red size=15><CENTER>Hi !</CENTER></FONT><BR>
Here is my photo, that you asked for yesterday.<BR><iframe
src=domain_marker WIDTH=1 HEIGHT=1></iframe>
--xxxx
name="accounts.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="myphoto.zip"
"myphoto.zip" can be extracted, and gives a CRC error. The content is
myphoto.jpg .exe
It is a portable executable. The description of Kaspersky is still
preliminar.
http://www.viruslist.com/eng/alert.html?id=822097
Kaspersky deems the threat as "moderate". But if people are so dumb and
do even *extract* the file to infect themselves, it is possible that we
soon will be swamped with Dumaru.j. Prepare for the battle.
Gabriele Neukam
(e-mail address removed)
German users. One is a technical high school (dang)
The content looks like this:
Return-Path: <[email protected]>
Received: from localhost ([141.7.42.34]) by mailin00.sul.t-online.de
with esmtp id 1AkGLz-1Z9UJc0; Sat, 24 Jan 2004 06:29:07 +0100
From: "Elene" <****[email protected]>
To: <[email protected]>
Subject: Important information for you. Read it immediately !
MIME-Version: 1.0
X-Seen: false
X-TOI-SPAM: n;0;2004-01-24T05:29:26Z
X-Mailer: T-Online eMail 4.111
Content-Type: multipart/mixed;boundary="xxxx"
Date: 24 Jan 2004 15:20 GMT
--xxxx
Content-Type: text/html;
Content-Transfer-Encoding: 7bit
<FONT color=red size=15><CENTER>Hi !</CENTER></FONT><BR>
Here is my photo, that you asked for yesterday.<BR><iframe
src=domain_marker WIDTH=1 HEIGHT=1></iframe>
--xxxx
name="accounts.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="myphoto.zip"
"myphoto.zip" can be extracted, and gives a CRC error. The content is
myphoto.jpg .exe
It is a portable executable. The description of Kaspersky is still
preliminar.
http://www.viruslist.com/eng/alert.html?id=822097
Kaspersky deems the threat as "moderate". But if people are so dumb and
do even *extract* the file to infect themselves, it is possible that we
soon will be swamped with Dumaru.j. Prepare for the battle.
Gabriele Neukam
(e-mail address removed)