RE: [Declude.Virus] Forging candidate - JS/IFrame@exp

2004-09-17 Thread John Tolmachoff \(Lists\)
Woops, wrong one sort of. This one calls another url within the HTML body.   Yes, it is forging.   John Tolmachoff Engineer/Consultant/Owner eServices For You   -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) S

RE: [Declude.Virus] Forging candidate - JS/IFrame@exp

2004-09-17 Thread John Tolmachoff \(Lists\)
I think this is the one where the html body calls an object from a URL which will automatticly download the virus payload.   John Tolmachoff Engineer/Consultant/Owner eServices For You   -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of M

[Declude.Virus] Forging candidate - JS/IFrame@exp

2004-09-17 Thread Matt
In the last hour we have started to see F-Prot tag something called JS/[EMAIL PROTECTED]  There were 13 of them since 4 p.m. EST and they don't appear at all in yesterday's logs.  This appears to be all spam from forged addresses.  Here are some Mail From addresses according to the Virus log: