Scott, What is interesting is that I do not get the warning message that you get!
What version of F-Prot are you using? Declude? I am using 1.79i8 09/07/2004 01:55:09 Q4d2710a401bcc5b2 MIME file: [text/html][quoted printable; Length=1452 Checksum=129510] 09/07/2004 01:55:10 Q4d2710a401bcc5b2 Scanner 2: Virus= the JS/Zerolin trojan !!! Attachment= [2] O 09/07/2004 01:55:10 Q4d2710a401bcc5b2 File(s) are INFECTED [ the JS/Zerolin trojan !!!: 13] 09/07/2004 01:55:10 Q4d2710a401bcc5b2 Scanned: CONTAINS A VIRUS [MIME: 2 1718] 09/07/2004 01:55:10 Q4d2710a401bcc5b2 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [outgoing from 218.13.55.73] 09/07/2004 01:55:10 Q4d2710a401bcc5b2 Subject: appointment reminder Goran Jovanovic The LAN Shoppe > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.Virus- > [EMAIL PROTECTED] On Behalf Of Scott Fisher > Sent: Tuesday, September 07, 2004 5:35 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.Virus] JS/Zerolin > > Like you, AVG and F-Prot don't catch them here but Virusscan does. Declude > Virus does toss out a warning: Warning: file#=224 (00000224.js ... ) > > Also seems to be a dictionary type attack given the recipients names. > > 09/05/2004 11:08:01 Q39d809bf029cc654 MIME file: [text/html][quoted- > printable; Length=2086 Checksum=144666] > 09/05/2004 11:08:01 Q39d809bf029cc654 Found potentially dangerous stuff in > D:\IMail\spool\D39d809bf029cc654.vir\0.! > 09/05/2004 11:08:02 Q39d809bf029cc654 Warning: file#=224 (00000224.js ... > ) > 09/05/2004 11:08:02 Q39d809bf029cc654 Scanner 3: Virus= the JS/Zerolin > trojan !!! Attachment=[Unknown: Err] [26] O > 09/05/2004 11:08:02 Q39d809bf029cc654 File(s) are INFECTED [ the > JS/Zerolin trojan !!!: 13] > 09/05/2004 11:08:02 Q39d809bf029cc654 Scanned: CONTAINS A VIRUS [MIME: 2 > 2344] > 09/05/2004 11:08:02 Q39d809bf029cc654 From: [EMAIL PROTECTED] To: > [EMAIL PROTECTED] [outgoing from 203.200.31.7] > 09/05/2004 11:08:02 Q39d809bf029cc654 Subject: submissions end september > 28th - Sun, 05 Sep 2004 14:05:50 -0200 > > Scott Fisher > Director of IT > Farm Progress Companies > > >>> [EMAIL PROTECTED] 09/07/04 04:26PM >>> > Hi, > > I am seeing my McAfee scanner catch these JS/Zerolin viruses but FProt > (3.15a) does not see them at all. > > Does anyone know why that might be? > > > > Goran Jovanovic > The LAN Shoppe > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.