[CQ-Contest] Vicious CQWW Virus

[Timo Klimoff]

> I recently received email from somebody identified as "DXCC Robot" and
> containing a very suspicious looking attachment.  The actual email address
> was unreplyable at mail.ru.  The message body began as follows:
>
> "Thank you for your participation in the CQ WW contest. Your electronic
log
> submission is appreciated.  Unfortunately, our robot was unable to process
> your Cabrillo log file
> as submitted because it appears to be missing some critical information.
> Below you will find a list of the problems that were encountered in
> attempting to process your log, as well as a
> corresponding set of remedies..."
>
> Then followed the attachment, which was named "All-bdxcc.xls.scr".

This looks like Bugbear - virus.
(maybe Bugbear.B)

The subject of an infected message is taken from random files on an infected
computer and the body of an infected message can be empty or it can contain
a text from a random file.

http://www.f-secure.fi/v-descs/bugbear_b.shtml

I presume that everyone has noticed wildly spreading Sobig.F and remember:
the sender information of these mails is wrong and doesn't indicate the real
infected user.

73, Timo OH1NOA

ObContest:
Scandinavian Activity Contest 20.-21.9.2003 CW 1200-1200z
Scandinavian Acitivity Contest 27.-28.9.2003 SSB 1200-1200z