| |
M1CUK > INFO 09.11.02 03:31l 48 Lines 1580 Bytes #999 (0) @ WW
BID : E82559M1CUK
Read: DB0FHN GUEST
Subj: virus / worm update
Path: DB0FHN<DB0ZWI<DB0CHZ<DB0ERF<DB0FBB<DB0GOS<DB0ACC<ON0RAT<ON0DXC<WA7V<
RZ6HXA<SP7MGD<WB0TAX<E21CJN<GB7FCR
Sent: 021109/0034Z @:GB7FCR.#16.GBR.EU #:27345 [Blackpool] FBB-7.03a $:E82559M1
From: M1CUK@GB7FCR.#16.GBR.EU
To : INFO@WW
This variant of WORM_FRIENDGRT.A is a "Friend Greetings" application that
sends out an invitation email to all addresses listed on the system's
Microsoft Outlook contact list.
The details of the email that it sends are as follows:
Subject: <Recipient> you have an E-Card from <Sender>
Message Body: Greetings!
has sent you an E-Card -- a virtual postcard from FriendGreetings.com. You
can pickup your E-Card at the FriendGreetings.com by clicking on the link
below.
http://www.frie<BLOCKED>eeting.com/203746/pickup.html?
Message:
------------------------------------------------------------?
<Recipient>, I sent you a greeting card. Please pick it up.?
<Sender>?
------------------------------------------------------------?
Once a recipient clicks the URL on this message, he or she is prompted for
the installation of this worm program. And as soon as this installation
concludes, this worm immediately mass-mails the described message.
Other variants of this worm send out the following links instead:
http://www.<BLOCKED>-greetings.com/pickup/pickup.aspx?code=<sender>&id=<id
number>
http://www.<BLOCKED>-cards.net/pickup/pickup.html?code=<sender>&id=<id
number>
-----------------------------
73's
Trev,
SysOp GB7FCR
E-Mail trev@gb7fcr.co.uk
Web Site http://www.gb7fcr.co.uk
AX25 - tcp/ip - Telnet - axip - RF & Internet Linked System's
Located in Blackpool,Lancashire,On the North West Coast of the UK
Message timed: 23:34 on 08 Nov 02
Message sent using WinPack-Telnet V6.80
Read previous mail | Read next mail
| |
