Hi, Wel it is happening al lot more now and C:\Temp>grep -i zerohour vir0506.log 05/06/2008 00:57:58.462 q90f204c2000085d1.smd ZEROHOUR Reports VIRUS: Unknown 05/06/2008 00:57:58.462 q90f204c2000085d1.smd File(s) are INFECTED [ZEROHOUR Unknown] 05/06/2008 00:58:23.994 q910c05dc000085ee.smd ZEROHOUR Reports VIRUS: Unknown 05/06/2008 00:58:23.994 q910c05dc000085ee.smd File(s) are INFECTED [ZEROHOUR Unknown] 05/06/2008 11:20:00.552 q22b604dc0000df98.smd ZEROHOUR Reports VIRUS: Unknown 05/06/2008 11:20:00.552 q22b604dc0000df98.smd File(s) are INFECTED [ZEROHOUR Unknown] 05/06/2008 11:40:16.701 q276105370000e398.smd ZEROHOUR Reports VIRUS: Unknown 05/06/2008 11:40:16.701 q276105370000e398.smd File(s) are INFECTED [ZEROHOUR Unknown] 05/06/2008 19:52:39.166 q9ad505b6000054de.smd ZEROHOUR Reports VIRUS: Unknown 05/06/2008 19:52:39.166 q9ad505b6000054de.smd File(s) are INFECTED [ZEROHOUR Unknown] 05/06/2008 20:06:40.255 q9e0c04c200005a91.smd ZEROHOUR Reports VIRUS: Unknown 05/06/2008 20:06:40.255 q9e0c04c200005a91.smd File(s) are INFECTED [ZEROHOUR Unknown]
But: 05/06/2008 00:57:58.744 q90f204c2000085d1.smd Scanner 1: Virus=: W32/[EMAIL PROTECTED] Attachment=document.zip [50] I 05/06/2008 00:58:24.213 q910c05dc000085ee.smd Scanner 1: Virus=: HTML/IFrame Attachment=[HTML segment] [50] I 05/06/2008 11:20:00.755 q22b604dc0000df98.smd Scanner 1: Virus=: W32/[EMAIL PROTECTED] Attachment=data.zip [50] I 05/06/2008 11:40:16.904 q276105370000e398.smd Scanner 1: Virus=: HTML/IFrame Attachment=[HTML segment] [50] I 05/06/2008 19:52:39.416 q9ad505b6000054de.smd Scanner 1: Virus=: W32/[EMAIL PROTECTED] Attachment=message.zip [50] I 05/06/2008 20:06:40.474 q9e0c04c200005a91.smd Scanner 1: Virus=: HTML/IFrame Attachment=[HTML segment] [50] I In each instance ZEROHOUR reported a virus but did not know what it was, one of my other scanners DID know what it was and reported it so. I sure hope Declude will change this behaviour and report the known virus name when one of the scanners DOES report a name. I'm right now using Declude 4.3.64, I'll start using 4.4.0 later this week. Met vriendelijke groet, Bonno Bloksma hoofd systeembeheer tio hogeschool hospitality en toerisme begijnenhof 8-12 / 5611 el eindhoven t 040 296 28 28 / f 040 237 35 20 [EMAIL PROTECTED] / www.tio.nl ----- Original Message ----- From: David Barker To: declude.virus@declude.com Sent: Monday, May 05, 2008 9:53 PM Subject: RE: [Declude.Virus] ZEROHOUR caught a virus It could be ZEROHOUR as it identifies viruses based on attributes other than virus signatures thereby providing zerohour protection, in many cases the virus has no name as it has not been identified yet. David B From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Monday, May 05, 2008 2:52 PM To: declude.virus@declude.com Subject: RE: [Declude.Virus] ZEROHOUR caught a virus If I remember correctly, it is not the ZEROHOUR spam test catching a virus. It is the internal AVG virus scanner saying it has caught an unknown virus, or what it thinks is a virus. Kevin Bilbee From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno Bloksma Sent: Sunday, May 04, 2008 11:27 PM To: Declude.Virus@declude.com Subject: [Declude.Virus] ZEROHOUR caught a virus Hi, Suddenly ZEROHOUR starts catching virusses but it does not know WHAT it caught. ----------<quote>------------------------------- Declude Virus v4.3.64 caught the ZEROHOUR Unknown virus in readme.zip from [Forged] to: [EMAIL PROTECTED] Date: 04 May 2008 12:36:21 Subject: Returned mail: see transcript for details Spool File: D7b90047b0000bde0.smd Remote IP: 77.42.92.137 ----------<quote>------------------------------- From the virlog: ----------<quote>------------------------------- C:\Temp>GREP -i 0000BDE0 vir0504.log 05/04/2008 12:36:21.061 q7b90047b0000bde0.smd Vulnerability flags = 0 05/04/2008 12:36:21.076 q7b90047b0000bde0.smd MIME file: readme.zip [base64; Length=29054 Checksum=3149200] 05/04/2008 12:36:21.139 q7b90047b0000bde0.smd ZEROHOUR Reports VIRUS: Unknown 05/04/2008 12:36:21.139 q7b90047b0000bde0.smd File(s) are INFECTED [ZEROHOUR Unknown] 05/04/2008 12:36:21.342 q7b90047b0000bde0.smd Virus scanner 1 reports exit code of 3 05/04/2008 12:36:21.342 q7b90047b0000bde0.smd Forging virus found: Likely forged sender was [EMAIL PROTECTED] 05/04/2008 12:36:21.342 q7b90047b0000bde0.smd Scanner 1: Virus=: W32/[EMAIL PROTECTED] Attachment=readme.zip [50] I 05/04/2008 12:36:21.342 q7b90047b0000bde0.smd Scanned: CONTAINS A VIRUS [MIME: 2 29533] 05/04/2008 12:36:21.342 q7b90047b0000bde0.smd From: [Forged] To: [EMAIL PROTECTED] [incoming from 77.42.92.137] 05/04/2008 12:36:21.342 q7b90047b0000bde0.smd Subject: Returned mail: see transcript for details ----------<quote>------------------------------- I seems one of my other scanners thinks it's a virus as well, and... it reports a name. 1) I've seen a ZEROHOUR virus just once before, is this a new feature? 2) Does ZEROHOUR ever know the name of the virus? 3) Could we have a new feature where Declude uses the "real" name of a virus when multiple scanners report a virus and some don't know the name? Met vriendelijke groet, Bonno Bloksma hoofd systeembeheer tio hogeschool hospitality en toerisme begijnenhof 8-12 / 5611 el eindhoven t 040 296 28 28 / f 040 237 35 20 [EMAIL PROTECTED] / www.tio.nl --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
