Yes, same here. And many of the recipient addresses are munged or otherwise invalid addresses that tend to receive a lot of spam.
F-Secure's weblog reported "the sample appears to a variant of Mitglieder trojan that is closely related to Bagle. It doesn't have replication mechanism of its own, so it was probably spammed out using some other proxy trojans or a new Bagle worm variant". http://www.f-secure.com/weblog/ Virustotal.com reports that many AV vendors call it a Bagle variant, Symantec calls the trojan Trojan.Tooso.F, and F-Prot calls it Mitglieder. - Siobhan Siobhan Jackson WA State AG's Office -----Original Message----- From: Durkee, Peter [mailto:[EMAIL PROTECTED] Sent: Wednesday, April 20, 2005 1:35 PM To: Exchange Discussions Subject: RE: Possible new virus Is anyone else noticing that they are only getting only one copy of this new Bagle variant sent to their domain from any one ip address? That seems to be the case here anyway, and it's a pattern I haven't ever seen before. -Peter [snip] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
