Hi, At first I was going to write: > Just upgraded f-prot from 3.11a to 3.12c and now I noticed that a Lentin.F > virus was found in a file attacment with the .txt extention.
Then, because I had a look again at this e-mail when it was reformatted with CR's I noticed the .bat about 100 spaces later. Now this is a "nice" way for a virus to disguise the real extention ;-) but..... can Declude do something about this in the reporting of the filename? I was thinking about reducing any whitespace block of over 5 spaces/tabs to just 5 spaces. That way the idea is still visible (lots of whitespace in a filename) but now it is visible, in stead of hidden beyond the end of our screen. Met vriendelijke groet, Bonno Bloksma ----- Original Message ----- From: "Postmaster" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, December 09, 2002 11:28 AM Subject: Declude Virus caught a virus > Declude Virus v1.53 caught the : W32/Lentin.F@mm virus in Wanadoo instellingen.txt .bat > from [EMAIL PROTECTED] to: [EMAIL PROTECTED] > > Date: 12/09/2002 11:28:59 > Subject: Fw: Wanadoo instellingen > Spool File: D702f00a2013211b4.SMD > Remote IP: 81.68.37.112 > > Headers: > Received: from mail.tio.nl [81.68.37.112] by mailie.tio.nl > (SMTPD32-7.07) id A02FA20132; Mon, 09 Dec 2002 11:27:59 +0100 > From: buurmana<[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Subject: Fw: Wanadoo instellingen > Date: Mon,09 Dec 2002 11:25:50 PM > X-Mailer: Microsoft Outlook Express 5.50.4133.2400 > MIME-Version: 1.0 > Content-Type: multipart/mixed; > boundary=txmgvld > Message-Id: <[EMAIL PROTECTED]> --- [This E-mail scanned for viruses by Declude Virus using f-prot] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
