Virus Alert: Hinh anh buon nhat Worldcup 2002

Dear All,

the following link seems to contain a virus.

I got the mail some minutes ago
From: Worldcup <wc2002@hn.vnn.vn>
but it looks like it was sent to a mailserver in HCMC, i.e. it might have
been sent in HCMC:
Received: from [203.162.70.14] ([203.162.70.14]) by
hcm-mail-prepaid.vnn.vn (Netscape Messaging Server 4.15) with
SMTP id GXOQPG00.0H0 for <stefan.probst@hn.vnn.vn>; Fri, 14 Jun
2002 14:41:40 +0700
(Tung, can you trace the sender?)
Note also, that they use again my hn.vnn.vn address, not my "normal" one.
It looks like there is a spamming list, which is meanwhile used also for
distributing viruses.

Note: Be careful with using those links below!!

In the mail below, the underlying link (behind "Hinh anh buon") is
http://209.126.156.67/zidane.htm, which in turn opens a window with URL
http://hackerforum.f2g.net/vtintuc.html. After 60 seconds the browser is
closed automatically. Nothing more seemed to happen on my Mozilla. With my
IE5.5 I got however a virus alert concerning a VBS script. On closer
examination it turns out, that the second page (vtintuc.html) tries to
write a file "2ascii.bin"....

Watch out!!!
Stefan

At 07:11 14.06.2002 +0700, Worldcup wrote:
-------------------------

>Worlcup 2002 that soi dong,nhung chung ta cung da chung kien nhieu su kien
>dien ra.
>
>Day la hinh anh buon nhat cua worldcup:
>
>Hinh anh buon
>
>
>
>
>