I have been trying to follow the posts...what rule would I use to block this
attachment? I know I put it in the body, is it just message.zip?
---
[This E-mail was scanned for viruses by QuestNet.net (http://www.QuestNet.net)]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.
Hi,
Just as the last few times, this one was being caught by McAfee right from
the start. (It had been proactively detected for the last 10 weeks or so.)
I don't understand how other its gotten past Declude for other customers?
Every occurrence I've seen came from "admin@" the user's domain and
Title: Message
Thanks Kami, I agree completely, I added both lines
here as well, but was just curious. I'm all for overdoing it as opposed to
underdoing it. =) Like you said, why take the chance?
Paul
Yes it is .. but
we know they both exist and why take a chance.. it is always best
is
less than just putting message().zip
Regards
Kami
-Original Message-From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of paulSent: Friday, August 01, 2003 3:40 PMTo:
[EMAIL PROTECTED]Subject: Re: [Declude.Virus] Message.zip
possible virus
Kami -
Wouldn'
Title: Message
Kami -
Wouldn't the bottom one
be enough? since filename has name in it already?
I want to make sure I'm looking at
this correctly. What a pain, I've seen an increase of these here as well, had
the "Did you send this to me?" emails due to the admin@ address.
Pa
Tolmachoff (Lists)
Sent: Friday, August 01, 2003
12:55 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus]
Message.zip possible virus
I
just received 4 of them.
The
html file inside looks very suspious.
John
Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For
You
Title: Message
Hi;
We have received
several... in all of them this is also in common..
===
X-Mailer: The Bat!
(v1.61)X-Priority: 2 (High)Subject: [47~]your
account
koikrairMIME-Version: 1.0Content-Type: multipart/mixed;
boundary="---
st
Gannett Television
716-849-2272
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of i360 Support
Sent: Friday, August 01, 2003 1:01 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] Message.zip possible virus
Sent
- Original Message -
From: "
Tolmachoff (Lists)
Sent: Friday, August 01, 2003
12:55 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus]
Message.zip possible virus
I
just received 4 of them.
The
html file inside looks very suspious.
John
Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For
You
PROTECTED]
Subject: Re: [Declude.Virus] Message.zip possible virus
I have sent the file to you.
It failed nothing, but it was blocked as a zip file.
JP
- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, Augu
I have sent the file to you.
These do look very suspicious. It appears as though they are malformed
viruses -- specifically, the message.zip file contains a file
message.htm. The message.htm file appears to start with MIME headers,
followed by a file "foo.exe" that appears to connect to the I
: Friday, August 01, 2003 9:31
AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus]
Message.zip possible virus
I just got one of these myselfit looks kinda like an
executable hidden in an HTML file ??
Anyone with more expertise than I care to look at the 'D&
I have sent the file to you.
It failed nothing, but it was blocked as a zip file.
JP
- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, August 01, 2003 12:44 PM
Subject: Re: [Declude.Virus] Message.zip possib
y, August 01, 2003 9:45 AM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.Virus] Message.zip possible virus
>
>
> >I just got one of these myselfit looks kinda like an executable
hidden
> >in an HTML file ??
> >
> >Anyone with more expertise than I care to l
Sent
- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, August 01, 2003 11:44 AM
Subject: Re: [Declude.Virus] Message.zip possible virus
>
> >I just got one of these myselfit looks kinda like an
Feel free to send it to [EMAIL PROTECTED] (just be sure to let me
know
after you send it, as that mailbox isn't monitored).
-Scott
Guess we are all curious now as to what it is.
Sharyn
We are the worldwide producer and marketer of the awar
I just got one of these myselfit looks kinda like an executable hidden
in an HTML file ??
Anyone with more expertise than I care to look at the 'D' file ??
Feel free to send it to [EMAIL PROTECTED] (just be sure to let me know
after you send it, as that mailbox isn't monitored).
I just got one of these myselfit looks kinda
like an executable hidden in an HTML file ??
Anyone with more expertise than I care to look at
the 'D' file ??
JP
- Original Message -
From:
i360 Support
To: [EMAIL PROTECTED]
Sent: Friday, August 01, 2003 11:49
18 matches
Mail list logo
