Hi,
I am seeing my McAfee scanner catch these JS/Zerolin viruses but FProt
(3.15a) does not see them at all.
Does anyone know why that might be?
Goran Jovanovic
The LAN Shoppe
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail
Like you, AVG and F-Prot don't catch them here but Virusscan does. Declude Virus does
toss out a warning: Warning: file#=224 (0224.js ... )
Also seems to be a dictionary type attack given the recipients names.
09/05/2004 11:08:01 Q39d809bf029cc654 MIME file:
, September 07, 2004 5:35 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] JS/Zerolin
Like you, AVG and F-Prot don't catch them here but Virusscan does.
Declude
Virus does toss out a warning: Warning: file#=224 (0224.js ...
)
Also seems to be a dictionary type attack given
In the last hour
I've seen some JS/Zerolin
Virus warnings are
comming back as NDR's
Mailfrom looks
random or at least forged.
Markus
In the last hour I've seen some JS/Zerolin
Virus warnings are comming back as NDR's
Mailfrom looks random or at least forged.
That is strange -- that appears to be a trojan horse, and therefore should
not spread. We'll look into it.
-Scott
---
Brand NEW version of a year old virus.
McAfee just release BRIEF info on it, dated today.
http://vil.nai.com/vil/content/v_127464.htm
3 here also. All three different IPs.
The VBS version is a year old trojan, it would have been very unusual
for that to waking up.
An odd file name. All my
PROTECTED]
Subject: Re: [Declude.Virus]
JS/Zerolin
Brand NEW version of a year old virus.
McAfee just release BRIEF info on it, dated today.
http://vil.nai.com/vil/content/v_127464.htm
3 here also. All three different IPs.
The VBS version is a year old trojan, it would have been very unusual
