[Esd-l] xmascottage.shs

[Dan Riley]

Brett Glass <brett at lariat.org> writes:
> We're seeing (and blocking!) mass mailings of a file with the name
> xmascottage.shs. The messages bearing this attachment are always
> addressed to many people at once and never seem to have text -- just
> the attachment. To paraphrase an old Christmas song, "What worm is
> this...?"

The one copy we've intercepted had text and some other attachments
that did not look at all virusy.  'strings' on xmascottage.shs seemed
to show it to be Crimbo.exe, a Flash christmas card that made the
rounds last year.  I'm rather suspicious of it being packed up as a
scrap object, but NAV didn't recognize it as anything in particular.
-- 
Dan Riley                                         dsr at mail.lns.cornell.edu
 "Mr. Ellison is presently the sole member of the Plan Committee.  The
  Plan Committee did not meet during fiscal year 2001, and during that
       same period, acted 46 times by unanimous written consent."