Using Forefront, and message tracking logs don't find anything with that subject line all day.
From: Doug Rooney [mailto:[email protected]] Sent: Thursday, September 09, 2010 4:10 PM To: MS-Exchange Admin Issues Subject: RE: Possible Email Virus I guess I am happy with what I pay Message Labs, we have had zero come in. Thank You [Description: file:///S:/Meadow%20Stebbins/Individuals/images/DRooney_01.jpg] -----Original Message----- From: Maglinger, Paul [mailto:[email protected]] Sent: Thursday, September 09, 2010 2:05 PM To: MS-Exchange Admin Issues Subject: RE: Possible Email Virus >From McCrappy - McAfee has received confirmation that some customers have received large volumes of spam containing a link to malware, a mass-mailing worm identified as VBMania. The symptom reported thus far is that the spam volume is overwhelming the email infrastructure. Static URLs in the email link to a .SCR file. McAfee recommends that customers filter for the URL on gateway and email servers, and block the creation of .SCR files on endpoint systems. McAfee Trusted Source is actively protecting against this threat. Customers with McAfee Trusted Source Email Reputation will have the emails blocked. Customers with McAfee Trusted Source Web Reputation will have the URL blocked from click-through. McAfee Artemis provides protection as well. -----Original Message----- From: Don Kuhlman [mailto:[email protected]] Sent: Thursday, September 09, 2010 3:08 PM To: MS-Exchange Admin Issues Subject: Re: Possible Email Virus Yep it hit here - put a filter on the inbox to delete anything with that subject while the mail / security team are working it. ----- Original Message ---- From: Charles A Ransom <[email protected]> To: MS-Exchange Admin Issues <[email protected]> Sent: Thu, September 9, 2010 2:44:10 PM Subject: Re: Possible Email Virus Just caught some - thanks! >>> "Kleciak, Clint D A7IT" >>> <[email protected]<mailto:[email protected]>> 9/9/2010 3:37 PM >>> >>> Reports of an email virus hitting some companies today. It has a link to a .scr file that looks like a PDF link. When users click it, it begins sending emails using the GAL or contacts. Not sure of the origin at this point but wanted to send a heads up. The email subject is "Here you have". --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected]<mailto:[email protected]> with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected]<mailto:[email protected]> with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected]<mailto:[email protected]> with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected]<mailto:[email protected]> with the body: unsubscribe exchangelist ************************************************************************************************** Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. ************************************************************************************************** --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe exchangelist
<<inline: image001.jpg>>
