FC: "Snow White" virus seems to be spreading via spam

[Declan McCullagh <declan () well com>]

A new Windows virus or worm appears to be spreading through spam. I 
received two copies of the below "Snowhite and the Seven Dwarfs" joke 
today. Attached to it was a file called "joke.exe" that Wired's email 
scanner (AMaViS, at amavis.org) flagged with this error message: "Our 
viruschecker found a VIRUS in your email"

I haven't attached the file in executable form because of the off chance 
that a politech reader using Windows will click on it by accident. But if 
you know how to uudecode and ungzip it, you can find it at:
  http://www.politechbot.com/docs/virus-joke.exe.gz.uu

Two points: 1. Never click on .exe or .vbs files if you're running Windows. 
(Those of us who use Linux mailreaders don't have this problem.) 2. Watch 
for congresscritters to use this (if it checks out) as more reasons to 
"regulate" spam next session.

-Declan

*******

Received: from smtp.well.com (smtp.well.com [208.178.101.27]) by 
mail.well.com (8.8.5/8.8.5) with ESMTP id UAA19192 for 
<declan () mail well com>; Wed, 29 Nov 2000 20:34:15 -0800 (PST)
Received: from cyber-monster (pppte08-220.ght.airmail.net [206.138.228.190])
by smtp.well.com (8.8.5/8.8.4) with SMTP id UAA26040 for <declan () well com>; 
Wed, 29 Nov 2000 20:33:55 -0800 (PST)
Date: Wed, 29 Nov 2000 20:33:55 -0800 (PST)
Message-Id: <200011300433.UAA26040 () smtp well com>
From: Hahaha <hahaha () sexyfun net>
Subject: Snowhite and the Seven Dwarfs - The REAL story!
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="--VEBOLIRSLEN"

Today, Snowhite was turning 18. The 7 Dwarfs always where very educated and
polite with Snowhite. When they go out work at mornign, they promissed a
*huge* surprise. Snowhite was anxious. Suddlently, the door open, and the Seven
Dwarfs enter...

[Attachment saved as joke.exe]




-------------------------------------------------------------------------
POLITECH -- the moderated mailing list of politics and technology
You may redistribute this message freely if it remains intact.
To subscribe, visit http://www.politechbot.com/info/subscribe.html
This message is archived at http://www.politechbot.com/
-------------------------------------------------------------------------