I have no trend prods or any sign-up with them. the received: header looks ok, from .de and the .fr.
Are they spamming me or is this something any of you Trend users have seen today? Len =================== >X-Persona: <Len MEI> >Received: from VirusGate.MEIway.com [212.73.210.91] by ms1.meiway.com with >ESMTP > (SMTPD32-6.06) id A63745DA020E; Wed, 27 Nov 2002 18:51:51 +0100 >Received: from localhost (localhost.meiway.com [127.0.0.1]) > by VirusGate.MEIway.com (Postfix) with SMTP id 1687D5D009 > for <[EMAIL PROTECTED]>; Wed, 27 Nov 2002 18:40:42 +0100 (CET) >Received: from mgw1.meiway.com (mgw1.meiway.com [212.73.210.75]) > by VirusGate.MEIway.com (Postfix) with ESMTP id 897CC5D008 > for <[EMAIL PROTECTED]>; Wed, 27 Nov 2002 18:40:41 +0100 (CET) >Received: from trendmicro-03.fra.de.colt-isc.net (unknown [217.110.201.54]) > by mgw1.meiway.com (Postfix) with ESMTP id DD685EF6A5 > for <[EMAIL PROTECTED]>; Wed, 27 Nov 2002 18:39:58 +0100 (CET) >Received: (from root@localhost) > by trendmicro-03.fra.de.colt-isc.net (8.11.6+Sun/Unknown) id > gARHdp108296 > for [EMAIL PROTECTED]; Wed, 27 Nov 2002 18:39:51 +0100 (MET) >Date: Wed, 27 Nov 2002 18:39:51 +0100 (MET) >Message-Id: <[EMAIL PROTECTED]> >Subject: Virus Pre-Information - 27.11.2002 (Virus Pre-Information) >From: [EMAIL PROTECTED] >Content-Type: text >To: undisclosed-recipients: ; >X-RCPT-TO: <[EMAIL PROTECTED]> >X-UIDL: 333247108 >Status: U > >Mr CONRAD, > >Virus Pre-Information - 27.11.2002 (Virus Pre-Information): > > > > > >This destructive Internet worm runs on all Windows platforms. This worm >propagates using its own SMTP or Simple Mail Transfer Protocol engine and >sends email to addresses it gathers from HTML files on the infected >system. It sends email with the following details: >Subject: N`4_Registered Organization >Message Body: Registered Owner - Registered Organization >Attachments: >WINrandom numeric value.GIF (120 bytes) MUSIC_2.CEO >WINrandom numeric value.TXT (12.6 KB) MUSIC_1.HTM >*Registered Owner is the registered owner of the machine and Registered >Organization is the organization of the owner. >This worm sends email using a known exploit that causes the attachment to >automatically execute when the message is viewed or previewed on Internet >Explorer-based email clients, such as Microsoft Outlook and Outlook >Express. This exploit is known as Automatic Execution of Embedded MIME type. >It is capable of terminating certain monitoring programs and antivirus >products from memory. >Upon restart, this worm deletes all files from local drives, except files >that are currently running on the system. >Infected Attachment(s) File Name(s) and/or Infected File(s): WINrandom >numeric value.GIF (120 bytes) MUSIC_2.CEO >_________________________________________ >Mail Receive or Generated by the malicious code: >Subject: >N`4_Registered Organization >Mail Body: >Registered Owner - Registered Organization >Infected Attachment(s) File Name(s) and/or Infected File(s): WINrandom >numeric value.GIF (120 bytes) MUSIC_2.CEO >_________________________________________ >BANDAGE PATTERN IS AVAILABLE on : >ftp.trendmicro-europe.com/aveu/Pattern/Bandage_27Nov2002.zip >ftp2.trendmicro-europe.com/trendlabs/Bandage_27Nov2002.zip >Bandage Pattern: 396 >MD5 key: ac6659b32e4aca42bf83bf9d3b6bf5f5 >Your Trend Micro products should be updated automatically with Official >Pattern. >Please verify your products are updated, if not, please unzip this file to >the Trend Micro Products directory. >_________________________________________ >Virus Information Web Site: >http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_WINEVAR.A&VSect=T >_________________________________________ >Best Regards, >24x7 European Outbreak Alert Team. >TrendLabs Anti-Virus Europe, a part of Trend Micro Inc. >http://ftp://ftp.trendmicro-europe.com/aveu/Pattern/Bandage_27Nov2002.zip > > > > Update your subscription profile: > http://fr.trendmicro-europe.com/enterprise/about_us/change.php?id=13047
