New Virus Alert! W32/ELKERN.C

mike65

Here we go again, i just got an .exe called USEMAP.
It came with two html files from
bandman@magiccarpet.com

Heres the header info.

Return-Path:
<edc@dti.gov.ph>
Received:
from server2.dti.gov.ph ([203.172.27.130]) by fargo.iolfree.ie (8.9.3/8.9.3) with ESMTP id QAA11081 for <mike65@iolfree.ie>; Tue, 4 Feb 2003 16:19:24 GMT
Received:
from Fomoyl ([192.168.0.79]) by server2.dti.gov.ph (8.9.3 (PHNE_18546)/8.9.3) with SMTP id BAA26199 for <mike65@iolfree.ie>; Wed, 5 Feb 2003 01:05:24 +0800 (EAT)
Date:
Wed, 5 Feb 2003 01:05:24 +0800 (EAT)
Message-Id:
<200302041705.BAA26199@server2.dti.gov.ph>
From:
bandman <bandman@magiccarpet.com>
To:
mike65@iolfree.ie
Subject:
Your password
MIME-Version:
1.0
Content-Type:
multipart/alternative; boundary=E0tdovPREj2w5g4Bf1q3H54592f0
X-UIDL:
^2>"!QgF!!#&l"!i[O!!

Mike.

MiCr0

http://securityresponse.symantec.com/avcenter/venc/data/w32.elkern.4926.html

mike65

Yeah there seesm to no end to the proliferation of the w32 Elkern worm.

I knew it was a bad un as soon as I saw it was an .exe

Who the hell would click an .exe these days?

Mike.