Re: New variant of Virus ?

[Gary Flynn <flynngn () jmu edu>]

Hubbard, Dan wrote:

> It looks like there maybe a new variant of the virus MyDoom worm. We
> have seen the following:
>
> RE: I still love you  fLctv 
>
> Error 551: We are sorry your UTF-8 encoding is not supported by the
> server, so the text was automatically zipped and attached to this
> message.
>
> The file attached is message.zip and unzips to message.exe
>
> I am analyzing the file for behavior and will update, but has anyone
> else seen this yet ?

We've seen several of these here since yesterday. I submitted
it last night and was told third-hand that the following Sophos
definition was created for it:

http://www.sophos.com/virusinfo/analyses/trojstawina.html

--
Gary Flynn
Security Engineer - Technical Services
James Madison University



---------------------------------------------------------------------------
----------------------------------------------------------------------------