Full Disclosure mailing list archives

Re: new virii? - Tinh` cho khong bieu' khong

From: KF <dotslash () snosoft com>
Date: Wed, 27 Aug 2003 14:18:02 +0000

From what I can tell it is just a variant of Lovelor (which wasmentioned by someone else)


It does not however have the same behavior as the one listed at
http://www.f-secure.com/v-descs/lovelorn.shtml

In particular it differs here:

The "From" address of these e-mails are always set to be one of thefollowing addresses: 'lovelorn () yahoo com', 'love_lorn () yahoo com' or'thuyquyen () yahoo com'.

The mail I recieved was from my own email address so there may be avariant that spoofs the from address.


-KF


LaRose, Dallas wrote:

Google search:
http://www.google.com/search?hl=en&lr=&ie=UTF-8&oe=UTF-8&q=%2B%22Tinh%60+cho
+khong+bieu%27+khong%22+%2Bvirus

Take the first hit and then search on a US virus site:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_LOVELOR
N.A

Does this look familiar?


-----Original Message-----

From: KF [mailto:dotslash () snosoft com]Sent: Wednesday, August 27, 2003 7:09 AM

To: Full-Disclosure () Lists Netsys Com
Subject: [Full-disclosure] new virii? - Tinh` cho khong bieu' khong

is anyone familiar with a win32 based virus with the following text inthe email message?


</script><html>Tinh` cho khong bieu' khong</html>

It appears to drop a file named "temp.exe"

if anyone wants the .html I can send it your way...
-KF

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Current thread:

new virii? - Tinh` cho khong bieu' khong KF (Aug 27)
- Re: new virii? - Tinh` cho khong bieu' khong Gary Warner (Aug 27)
  - Re: new virii? - Tinh` cho khong bieu' khong Gary Warner (Aug 27)
- <Possible follow-ups>
- RE: new virii? - Tinh` cho khong bieu' khong LaRose, Dallas (Aug 27)
  - Re: new virii? - Tinh` cho khong bieu' khong KF (Aug 27)