If you allow .exe in Declude Virus product, you may want to add:
BANNAME RechnungGEZ.pdf.exe
to your virus.cfg file. See this antivirus company's blog entry:
http://www.f-secure.com/weblog/#00001080
"There's a fairly large malware spam run going on in Germany.
The emails claim to be from GEZ, the local TV permit authority. The mail
contains a bill for 445,99e for unpaid TV watching licenses."
The attachment, of course, is an executable: RechnungGEZ.pdf.exe. We now
detect this as Trojan-Downloader.Win32.Small.efe.
When run, the attachment shows a fake error message to explain why you
don't see the real bill after opening the attachment: [fake error
message reporting Acrobat 6 - Error "Warning" 20225]"
Andrew.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
