RE: [Declude.Virus] F-Prot and HTML object exploit

[John Tolmachoff \(Lists\)]

I saw it start at about 10:00 AM PDT.   Some one please contact F-Prot. I would but I am at a client trying to recover data from a failed hard drive. Fun.   John T eServices For You   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Don Hickey Sent: Monday, May 02, 2005 11:14 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] F-Prot and HTML object exploit   I am having the same problems here. It all started around 12:30 Central time...   Don ----- Original Message ----- From: Matt To: Declude.Virus@declude.com Sent: Monday, May 02, 2005 12:56 PM Subject: Re: [Declude.Virus] F-Prot and HTML object exploit   John, Thanks a bunch for pointing this out.  I have found two of these in the last hour that are tagging what appears to be legitimate E-mail, bother from the same person.  This is gatewayed E-mail: 05/02/2005 13:44:21 Q66F5EF3A00E815E6 MIME file: [text/html][quoted-printable; Length=6657 Checksum=558425] 05/02/2005 13:44:21 Q66F5EF3A00E815E6 Found potentially dangerous stuff in F:\D66F5EF3A00E815E6.vir\0.! 05/02/2005 13:44:21 Q66F5EF3A00E815E6 MIME file: image001.jpg [base64; Length=11748 Checksum=1305364] 05/02/2005 13:44:21 Q66F5EF3A00E815E6 MIME file: image002.gif [base64; Length=2184 Checksum=243507] 05/02/2005 13:44:22 Q66F5EF3A00E815E6 Scanner 1: Virus=HTML/[EMAIL PROTECTED] Attachment=[HTML segment] [0] O 05/02/2005 13:44:22 Q66F5EF3A00E815E6 File(s) are INFECTED [HTML/[EMAIL PROTECTED]: 0] 05/02/2005 13:44:22 Q66F5EF3A00E815E6 Deleting file with virus 05/02/2005 13:44:22 Q66F5EF3A00E815E6 Deleting E-mail with virus! 05/02/2005 13:44:22 Q66F5EF3A00E815E6 Scanned: CONTAINS A VIRUS [MIME: 4 21877] 05/02/2005 13:44:22 Q66F5EF3A00E815E6 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [outgoing from 208.7.179.200] 05/02/2005 13:44:22 Q66F5EF3A00E815E6 Subject: RE: NCC Docket 2005 - 2 It looks like turning F-Prot off might be a good idea, or at least configuring it to not delete viruses. Matt John Tolmachoff (Lists) wrote: It appears that something has updated on F-Prot in the last hour. Now, a lot of outbound HTML e-mails are being flagged  by F-Prot as having the HTML object exploit. Running the file on www.virustotal.com shows clean.   Any one else seeing problems?   For now, as I am at a client, I have turned off F-Prot scanning relying on AVG.   John T eServices For You       --- This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".    The archives can be found at http://www.mail-archive.com.       -- =====================================================MailPure custom filters for Declude JunkMail Pro.http://www.mailpure.com/software/=====================================================