From: Daytona 
Newsgroups: uk.finance
Subject: Re: Nationwide email scam
Date: Tue, 28 Oct 2003 12:24:56 +0000

On Sun, 26 Oct 2003 13:07:18 +0000, Daytona  wrote:

>On Sun, 26 Oct 2003 10:34:29 +0000, freezer@ntlworld.com quoted:
>
>>"Sunil Sood"  quoted:
>>>
>>>To verify your e-mail address and access your bank account,
>>>click on the link below. If nothing happens when you click on the
>>>link (or if you use AOL), copy and paste the link into
>>>the address bar of your web browser.
>>>
>>>
>>>http://www.nationwide.co.uk:ac=xxxxxxxxxxxxxxxxxxxx@ShOrTwAy.To/cgf4dl/?xxxxxxxxxxxxxx
>
>http://www.shortway.to/ is Russian - aserver.one.ru (193.124.133.29). The
>Nationwide fake page appears to have been removed and instead you go to the
>hosts home page - http://www.zerkalo.com/
>
>This site tries to infect your machine with JS/IEStart.gen.c according to
>McAfee.

It appears as if this virus is relatively benign - it simply changes the users
IE homepage according to McAfee -
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=99066

Daytona