Maybe the attachment was corrupted therefore not detectable?
Just one possibility.
john
Nope...Just had a user forward me 4 messages containing the Mydoom virus that came to him this afternoon. They were however caught the second time through modus. Makes me wonder if the virus definitions were finally updated to catch the new strain of Mydoom this afternoon.
Jim
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Cary Fitch
Sent: Tuesday, February 10, 2004 3:23 PM
To: [EMAIL PROTECTED]
Subject: [Modus] I wonder...
I wonder why my Modus 3 Server delivered it to me. :-)
Cary
Attend Peering Conference for ISP's,
April 23-24, 2004, Dallas Texas
Full info: http://www.peercon.org
- ----- Original Message -----
- From: John M. Troher
- To: [EMAIL PROTECTED]
- Sent: Tuesday, February 10, 2004 1:34 PM
- Subject: [Modus] I wonder...
- That�s MyDoom.A can tell by the text in the body. No doubt
- John
- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Cary Fitch
- Sent: Tuesday, February 10, 2004 2:18 PM
- To: [EMAIL PROTECTED]
- Subject: [Modus] I wonder...
- I just got this, which 66.226.66.69 which is an A+Net (aka Rodopi) address block. However I don't expect anything in particular from there, and have no idea who/what "raceface.com" might be. The size of the file "doc.zip" is 23.3k.
- And I am highly suspicous of any zips of binaries, that I am not expecting, Virus Scanning or no.
- Anyone have any thoughts on this?
- Cary Fitch
- Return-path: <[EMAIL PROTECTED]>
- Received: from raceface.com (unverified [66.226.66.69]) by ann.THE-I.NET
- (Vircom SMTPRS 3.0.282) with ESMTP id <[EMAIL PROTECTED]> for <[EMAIL PROTECTED]>;
- Tue, 10 Feb 2004 13:04:31 -0600
- Message-ID: <[EMAIL PROTECTED]>
- From: [EMAIL PROTECTED]
- To: [EMAIL PROTECTED]
- Subject: MAIL DELIVERY SYSTEM
- Date: Tue, 10 Feb 2004 11:04:30 -0800
- MIME-Version: 1.0
- Content-Type: multipart/mixed;
- boundary="----=_NextPart_000_0011_C70E8C4B.547C280A"
- X-Priority: 3
- X-MSMail-Priority: Normal
- This is a multi-part message in MIME format.
- ------=_NextPart_000_0011_C70E8C4B.547C280A
- Content-Type: text/plain;
- charset="Windows-1252"
- Content-Transfer-Encoding: 7bit
- The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
- ------=_NextPart_000_0011_C70E8C4B.547C280A
- Content-Type: application/octet-stream;
- name="doc.zip"
- Content-Transfer-Encoding: base64
- Content-Disposition: attachment;
- filename="doc.zip"
- Attend Peering Conference for ISP's,
- April 23-24, 2004, Dallas Texas
- Full info: http://www.peercon.org
