[Esa-l] Alright, guys, what is this?

[Dan Riley]

Brett Glass <brett at lariat.org> writes:
>The pattern I've added to John's sanitizer to trap hidden 
>extension exploits just caught this. What is it?
[...]
>> Content-Type: application/octet-stream; name="AnnaKournikova.jpg.6387DEFANGE
>D-vbs"
>> Content-Transfer-Encoding: quoted-printable
>> Content-Disposition: attachment; filename="AnnaKournikova.jpg.6387DEFANGED-v
>bs"

We caught several of these this morning from various mailing lists.
Appears to be a new virus--see

http://www.sophos.com/virusinfo/analyses/vbsssta.html

and note that http://www.sophos.com/downloads/ide/ lists this with
today's date.

--
Dan Riley                                         dsr at mail.lns.cornell.edu
Wilson Lab, Cornell University      <URL:http://www.lns.cornell.edu/~dsr/>
    "History teaches us that days like this are best spent in bed"