OK, that is strange. We started getting dozens of these too--but SMS for SMTP (SAVSMTP 4.0) immediately identified these as NetSky.M and deleted them. No infected zips got through.
Dev Tuesday, July 27, 2004, 10:21:11 AM, you wrote: TR> Follow -Up TR> Symantec is looking into it, it is not TR> MyDoom.m (or MyDoom.o). They are TR> puzzled because it has exactly the body and TR> appearance on a Netsky, but TR> attachment style of a MyDoom TR> Travis TR> -----Original Message----- TR> From: [EMAIL PROTECTED] TR> [mailto:[EMAIL PROTECTED] Behalf Of Travis Rabe TR> Sent: Tuesday, July 27, 2004 10:04 AM TR> To: [EMAIL PROTECTED] TR> Subject: RE: [IMail Forum] New Virus?? TR> I just opened this up on standalone machine - TR> my guinea pig - and it went TR> ape sh*t, so I am guessing new virus. TR> Travis TR> -----Original Message----- TR> From: [EMAIL PROTECTED] TR> [mailto:[EMAIL PROTECTED] TR> Behalf Of Michael Greenberg TR> Sent: Tuesday, July 27, 2004 9:55 AM TR> To: [EMAIL PROTECTED] TR> Subject: RE: [IMail Forum] New Virus?? TR> Hey, one of my users just had this same thing. TR> It bypassed our AV as well. TR> I'm looking into things further. Seems like it popped up overnight. TR> -----Original Message----- TR> From: [EMAIL PROTECTED] TR> [mailto:[EMAIL PROTECTED] TR> On Behalf Of Travis Rabe TR> Sent: Tuesday, July 27, 2004 12:45 PM TR> To: Imail User Forum TR> Subject: [IMail Forum] New Virus?? TR> Hey There, TR> Starting last night I received a few e-mail that came form TR> [EMAIL PROTECTED] and [EMAIL PROTECTED] TR> with zip file attachments. TR> Within those attachments are .scr and .htm.exe TR> files. Our SAVSMTP server TR> has the latest Symantec Definitions on them TR> and it detected nothing. I then TR> scanned the attachments with McAfee's latest TR> definitions, nothing. I then TR> did an online scan with Trend Micro - nothing. TR> Are these new or are these TR> just so mangled that they aren't being TR> detected? I have since sent them to TR> Symantec for review, but it seems a bit odd TR> that I would get so many and the TR> three different AV companies would not be able TR> to detect them. These are TR> not password protected zip files. For the TR> time being I just stopped TR> accepting .zip attachments. TR> Any ideas? TR> ---------------------------------------- TR> Travis Rabe TR> The Davidson Group TR> Technology Director TR> Work: (775) 832-8314 x108 TR> Cell: (775) 250-6526 TR> [EMAIL PROTECTED] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
