RE: [Declude.Virus] JS/Zerolin

[John Tolmachoff \(Lists\)]

Is the virus in an attachment, or part of an HTML body?   John Tolmachoff Engineer/Consultant/Owner eServices For You   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Greg Little Sent: Wednesday, August 11, 2004 3:43 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] JS/Zerolin   Brand NEW version of a year old virus. McAfee just release BRIEF info on it, dated today. http://vil.nai.com/vil/content/v_127464.htm 3 here also. All three different IPs. The VBS version is a year old trojan, it would have been very unusual for that to waking up. An odd file name. All my "froms" are random names also, so forging is likely. Greg Little Declude Virus Ver. 1.79 caught the  the JS/Zerolin trojan !!! virus in [Unknown: Err] from [EMAIL PROTECTED] to:  [EMAIL PROTECTED], [EMAIL PROTECTED].     from [EMAIL PROTECTED] to: from [EMAIL PROTECTED] to: Markus Gufler wrote: In the last hour I've seen some JS/Zerolin Virus warnings are comming back as NDR's   Mailfrom looks random or at least forged.   Markus     --- [This E-mail scanned for viruses by Findlay Internet] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.