Man I hate that. I can't put desktop AV here so Declude is it! They scream they have to have Hotmail then scream they have a virus. I love my job! Here come the men in white coats so I must go now!
~Paul~ -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Madscientist Sent: Thursday, April 25, 2002 10:10 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Declude and F-Prot Is it possible that the user also has an alternative account where they cought the bug? (We have users who also insist on keeping hotmail or other accounts - that is until they get hit with one of these). _M | -----Original Message----- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of Jim Rooth | Sent: Wednesday, April 24, 2002 6:53 PM | To: [EMAIL PROTECTED] | Subject: [Declude.Virus] Declude and F-Prot | | | | | | Jim Rooth | | I have a weird one here. Declude seems to be working fine | but here is the rub. It caught the Klez-H@mm coming into a | user and then it caught 30 instances of the user sending the | bug back out. ???? | | Here are parts of both virus messages: | | The incoming message: | | Declude Virus v1.46 caught the W32/Klez.H@mm virus in | setup.exe from [EMAIL PROTECTED] to: [EMAIL PROTECTED] | | Date: 04/24/2002 16:34:54 | Subject: A funny game | Spool File: D24e701910028c05b.SMD | Remote IP: 65.120.133.104 | | X-Virus-Name: W32/Klez.H@mm | | Headers: | outgoing | 1 | | ====================================== | Received: from Ufbcjf [65.120.133.104] by centralfreight.com | (SMTPD32-7.07) id A4E71910028; Wed, 24 Apr 2002 16:34:31 -0500 | From: grahamb <[EMAIL PROTECTED]> | To: [EMAIL PROTECTED] | Subject: A funny game | MIME-Version: 1.0 | Content-Type: multipart/alternative; | boundary=CX572978I8I5KbuWk3K92VITP8tBiL8W0 | Message-Id: <200204241634640.SM01180@Ufbcjf> | ====================================== | | One of 30 outgoing messages: | | Declude Virus v1.46 caught the W32/Klez.H@mm virus in | height.scr from [EMAIL PROTECTED] to: | [EMAIL PROTECTED] | | Date: 04/24/2002 16:59:02 | Subject: End banner ad | Spool File: D2a8902470028c447.SMD | Remote IP: 65.120.133.104 | | X-Virus-Name: W32/Klez.H@mm | | Headers: | outgoing | 1 | | ====================================== | Received: from Zpkjcp [65.120.133.104] by centralfreight.com | (SMTPD32-7.07) id AA892470028; Wed, 24 Apr 2002 16:58:33 -0500 | From: kwelch <[EMAIL PROTECTED]> | To: [EMAIL PROTECTED] | Subject: End banner ad | MIME-Version: 1.0 | Content-Type: multipart/alternative; | boundary=Y77k61j00V4C46C4209kEsR853Cf929jY | Message-Id: 200204241658843.SM01180@Zpkjcp | | Only thing I can figure is the virus was introduced by a | different mail account than ours. Perhaps hotmail, yahoo or | something similar. | | --- | Outgoing mail is certified Virus Free. | Checked by AVG anti-virus system (http://www.grisoft.com). | Version: 6.0.351 / Virus Database: 197 - Release Date: 4/19/2002 | | | --- | [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail scanned for viruses by Declude Virus/McAfee] --- [This E-mail scanned for viruses by Declude Virus/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
