It looks genuine. http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_WINEVAR.A
> -----Original Message----- > From: Len Conrad [mailto:[EMAIL PROTECTED]] > Sent: Thursday, 28 November 2002 06:57 > To: [EMAIL PROTECTED] > Subject: [IMGate] Fwd: Virus Pre-Information - 27.11.2002 (Virus > Pre-Information) > > > > I have no trend prods or any sign-up with them. the > received: header > looks ok, from .de and the .fr. > > Are they spamming me or is this something any of you Trend > users have seen > today? > > Len > > =================== > > >X-Persona: <Len MEI> > >Received: from VirusGate.MEIway.com [212.73.210.91] by > ms1.meiway.com with > >ESMTP > > (SMTPD32-6.06) id A63745DA020E; Wed, 27 Nov 2002 18:51:51 +0100 > >Received: from localhost (localhost.meiway.com [127.0.0.1]) > > by VirusGate.MEIway.com (Postfix) with SMTP id 1687D5D009 > > for <[EMAIL PROTECTED]>; Wed, 27 Nov 2002 > 18:40:42 +0100 (CET) > >Received: from mgw1.meiway.com (mgw1.meiway.com [212.73.210.75]) > > by VirusGate.MEIway.com (Postfix) with ESMTP id 897CC5D008 > > for <[EMAIL PROTECTED]>; Wed, 27 Nov 2002 > 18:40:41 +0100 (CET) > >Received: from trendmicro-03.fra.de.colt-isc.net (unknown > [217.110.201.54]) > > by mgw1.meiway.com (Postfix) with ESMTP id DD685EF6A5 > > for <[EMAIL PROTECTED]>; Wed, 27 Nov 2002 > 18:39:58 +0100 (CET) > >Received: (from root@localhost) > > by trendmicro-03.fra.de.colt-isc.net > (8.11.6+Sun/Unknown) id > > gARHdp108296 > > for [EMAIL PROTECTED]; Wed, 27 Nov 2002 18:39:51 > +0100 (MET) > >Date: Wed, 27 Nov 2002 18:39:51 +0100 (MET) > >Message-Id: > <[EMAIL PROTECTED]> > >Subject: Virus Pre-Information - 27.11.2002 (Virus Pre-Information) > >From: [EMAIL PROTECTED] > >Content-Type: text > >To: undisclosed-recipients: ; > >X-RCPT-TO: <[EMAIL PROTECTED]> > >X-UIDL: 333247108 > >Status: U > > > >Mr CONRAD, > > > >Virus Pre-Information - 27.11.2002 (Virus Pre-Information): > > > > > > > > > > > >This destructive Internet worm runs on all Windows > platforms. This worm > >propagates using its own SMTP or Simple Mail Transfer > Protocol engine and > >sends email to addresses it gathers from HTML files on the infected > >system. It sends email with the following details: > >Subject: N`4_Registered Organization > >Message Body: Registered Owner - Registered Organization > >Attachments: > >WINrandom numeric value.GIF (120 bytes) MUSIC_2.CEO > >WINrandom numeric value.TXT (12.6 KB) MUSIC_1.HTM > >*Registered Owner is the registered owner of the machine and > Registered > >Organization is the organization of the owner. > >This worm sends email using a known exploit that causes the > attachment to > >automatically execute when the message is viewed or > previewed on Internet > >Explorer-based email clients, such as Microsoft Outlook and Outlook > >Express. This exploit is known as Automatic Execution of > Embedded MIME type. > >It is capable of terminating certain monitoring programs and > antivirus > >products from memory. > >Upon restart, this worm deletes all files from local drives, > except files > >that are currently running on the system. > >Infected Attachment(s) File Name(s) and/or Infected File(s): > WINrandom > >numeric value.GIF (120 bytes) MUSIC_2.CEO > >_________________________________________ > >Mail Receive or Generated by the malicious code: > >Subject: > >N`4_Registered Organization > >Mail Body: > >Registered Owner - Registered Organization > >Infected Attachment(s) File Name(s) and/or Infected File(s): > WINrandom > >numeric value.GIF (120 bytes) MUSIC_2.CEO > >_________________________________________ > >BANDAGE PATTERN IS AVAILABLE on : > >ftp.trendmicro-europe.com/aveu/Pattern/Bandage_27Nov2002.zip > >ftp2.trendmicro-europe.com/trendlabs/Bandage_27Nov2002.zip > >Bandage Pattern: 396 > >MD5 key: ac6659b32e4aca42bf83bf9d3b6bf5f5 > >Your Trend Micro products should be updated automatically > with Official > >Pattern. > >Please verify your products are updated, if not, please > unzip this file to > >the Trend Micro Products directory. > >_________________________________________ > >Virus Information Web Site: > >http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VNa me=WORM_WINEVAR.A&VSect=T >_________________________________________ >Best Regards, >24x7 European Outbreak Alert Team. >TrendLabs Anti-Virus Europe, a part of Trend Micro Inc. >http://ftp://ftp.trendmicro-europe.com/aveu/Pattern/Bandage_27Nov2002.zip > > > > Update your subscription profile: > http://fr.trendmicro-europe.com/enterprise/about_us/change.php?id=13047
