wendy.zip - encrypted - mimail

[Mariano Absatz]

Hi Raymond... (or should I call you Greg?) ;-P

Thanx for the info... I didn't find it in my traps :-(

What I dislike is that NAI says (in the web: 
http://vil.nai.com/vil/content/v_100856.htm ) that the current dat files 
find & remove the ".m" release... 

I even forced a .dat update just in case they had re-released it, but the 
.dat's are identical...

Would you mind sending me an infected message to another account? I'd 
send you a request from that account (I can "double opt-in" if you want 
to be more assured).

El 4 Dec 2003 a las 16:00, Raymond Dijkxhoorn escribió:

> Hi!
> 
> > # NEW DETECTIONS
> > ...
> > # INTERNET WORM (33)
> > # ------------------
> > ...
> > # W32/MIMAIL.L at MM <--
> > ...
> > # NEW REMOVALS
> > # INTERNET WORM (33)
> > # ------------------
> > ...
> > # W32/MIMAIL.L at MM <--
> > ...
> >
> > However, later yesternight, a wendy.zip passed thru... would that be
> > innocuous? or a newer version of mimail?
> 
> Most likely the new M version.
> 
> http://www.sophos.com/virusinfo/analyses/w32mimailm.html
> 
> > Otherwise, a sample of possible subjects might help me find one thru one
> > of my unprotected spamtraps
> 
> Subject line: Re[3]<44 spaces><random characters>
> 
> Message text:
> 
> Hello Greg,
> 
> 
> 
> I was shocked, when I found out that it wasn't you but your twin
> brother!!! That's amazing, you're as like as two peas. No one in bed is
> better than you Greg. I remember, I remember everything very well, that
> promised you to tell how it was, I'll give you a call today after 9.
> 
<snip>

--
Mariano Absatz
El Baby
----------------------------------------------------------
When I was kidnapped, my parents snapped into action.
They rented out my room.
        -- Woody Allen