Its not a vbs worm, it's the Hybris worm.

http://www.f-secure.com/v-descs/hybris.shtml

http://www.zdnet.com/zdnn/stories/news/0,4586,2673789,00.html

-Jeremy

-----Original Message-----
From: Franklin, Joel [mailto:JDFranklin@moheck.com]
Sent: Thursday, February 22, 2001 9:23 AM
To: kclug@kclug.org
Subject: RE: spam

That's not spam; that's a Microsoft/Outlook/VBS worm. I've seen a lot of
these.

Now that you mention it, I got one today, too. I deleted it without looking
at it at all, but it's an interesting coincidence.

-----Original Message-----
From: Aravind Gottipati [mailto:slttg@cc.usu.edu]
Sent: Thursday, February 22, 2001 8:47 AM
To: kclug@kclug.org
Subject: spam

Hi,
	I am not sure if everyone got this, but today morning I got spam
mail. I looked at the headers and it looked like they somehow got my
address from the kclug list. It was from some porn site, I think.. The
address is "hahaha@sexyfun.net". I use fetchmail+postfix+procmail+mutt
combination. Is there an easy way to set up automatic bounce filters for
such stuff? Right now, I just take the address and make a procmail rule
directing all such mail to /dev/null, can our list set up automatic filters?