[76350] in North American Network Operators' Group
Trojaned versions of Makelovenotspam doing the rounds ...
daemon@ATHENA.MIT.EDU (Suresh Ramasubramanian)
Tue Dec 7 12:19:46 2004
Date: Tue, 07 Dec 2004 22:49:02 +0530
From: suresh@outblaze.com (Suresh Ramasubramanian)
To: nanog@merit.edu
Errors-To: owner-nanog-outgoing@merit.edu
What a surprise (or not!)
http://www.theregister.co.uk/2004/12/07/fake_lycos_screensaver_trojan/
> Virus writers have begun distributing their wares in emails that pose as
> Lycos's abandoned "Make love not spam" screensaver.
>
> The fake screensaver emails contain an attachment with a RAR SFX archive that
> has embedded key logger Trojan inside, antivirus firm Sophos warns. Infected
> emails come in emails with subject lines such as "Be the first to fight spam
> with Lycos screen" and an attachment called "Lycos screensaver to fight
> spam.zip".
>
> Upon successful installation, the key logging Trojan (Mdropper-IT) sends a
> message to an Indonesian email address confirming its status. The screensaver
> file, rather than displaying the Lycos screensaver, displays a blank screen.
[snip]
