From : (address is spoofed)
Subject : (blank)

Body Text:
        •     new price

  There is indication in the file that it may also try to 
password-protect some ZIP files, in which case it will add one of the 
following to the message body:
        •     The password is
        •      Password:

  The password will then be contained in an embedded image file.

Attachment: (may be one of the following)
        •     price.zip
        •      price2.zip
        •      price_new.zip
        •      price_08.zip
        •      08_price.zip
        •      newprice.zip
        •      new_price.zip
        •      new__price.zip

  The ZIP file contains PRICE.EXE and PRICE.HTML, as described above.

For more information see: http://vil.nai.com/vil/content/v_127423.htm

Information Security Services
University of Oklahoma
Health Science Center
http://www.ouhsc.edu/it/security/