[at-l] Virus

[WHHAWKINS@aol.com (WHHAWKINS@aol.com)]

In a message dated 7/25/2001 8:33:48 AM Eastern Daylight Time, ATnavi writes=
:


> I forget the exact content of the message, but it is always the same,=20
> something like "Will you have a look at this? See you later..."
>=20

The infected email can come from=20
addresses that you recognize. Attached is a file with two=20
different extensions. The file name itself varies.


The email message can appear as follows:=20

Subject: [filename (random)]=20
Body: [content varies]

Hi! How are you?=20
I send you this file in order to have your advice=20
or I hope you can help me with this file that I send=20
or I hope you like the file that I sendo you=20
or This is the file with the information that you ask for=20
See you later. Thanks=20

--- the same message may be received in Spanish ---

Hola como estas ?=20
Te mando este archivo para que me des tu punto de vista=20
or Espero me puedas ayudar con el archivo que te mando
or Espero te guste este archivo que te mando
or Este es el archivo con la informaci=F3n que me pediste=20
Nos vemos pronto, gracias.=20


The virus searches for .GIF, .JPG, .JPEG, .MPEG, .MOV, .MPG,=20
.PDF, .PNG, .PS, and .ZIP files in the MY DOCUMENTS folder=20
and attempts to send copies of these documents to email=20
recipients found in the Windows Address Book and addresses=20
found in cached files.=20



--- StripMime Report -- processed MIME parts ---
multipart/alternative
  text/plain (text body -- kept)
  text/html
---