Re: Another new worm???

[zoa_chien () INAME COM (Zoa_Chien)]

This file has the same header as the thisreallyworks.txt file that was send
in javascript a while ago (and that got placed on your desktop.
(just look in the vuln-dev list a while ago)

Zoa_Chien

> This copy was provided to the SecurityFocus folks today by Ron Greer.
> Password is "worm", without the quotes.
>
> It appears to be a known virus/worm:
>
> http://vil.mcafee.com/dispVirus.asp?virus_k=98668
>
> They're (McAfee) saying they got word on 5/30, and the deal is that it
> seems to have gotten loose today.
>
> Also:
>
> http://www.antivirus.com/pc-cillin/vinfo/virusencyclo/default5.asp?VName=VB
> S_STAGES.A
>
> It looks like it's got a Word header on it (which seems strange to me
> for a .shs extension) and it's partially obscufucated.  I'd be interested
> in seeing some analysis.
>
>                                         BB