Re: [Declude.Virus] Possible new virus

2005-10-06 Thread Darin Cox
: [Declude.Virus] Possible new virus We're seeing a lot of emails with pword_change.zip attached. May want to block it in your virus.cfg. Subject is"Your new Password" All so far were routed through gmx.net or web.de just before delivery, but are originating from a variety of dial-up or bro

[Declude.Virus] Possible new virus

2005-10-05 Thread Darin Cox
We're seeing a lot of emails with pword_change.zip attached. May want to block it in your virus.cfg. Subject is"Your new Password" All so far were routed through gmx.net or web.de just before delivery, but are originating from a variety of dial-up or broadband ISP accounts. Darin.

Re: [Declude.Virus] Possible new virus

2005-10-05 Thread Darrell \([EMAIL PROTECTED])
. - Original Message - From: Darin Cox To: Declude.Virus@declude.com Sent: Wednesday, October 05, 2005 10:33 PM Subject: [Declude.Virus] Possible new virus We're seeing a lot of emails with pword_change.zip attached. May want to block it in your virus.cfg

Re: [Declude.Virus] Possible new virus

2005-10-05 Thread Matt
This is scary. I verified the same pattern of the messages all being relayed through one of those two servers. The headers of the messages also show randomization in both the types of headers as well as the basic construct of things like message boundaries. This is very spammy, and it is a

Re: [Declude.Virus] Possible new virus

2005-10-05 Thread Darin Cox
My first hit was right around that time as well. That's a quick catch by FProt. Darin. - Original Message - From: Darrell ([EMAIL PROTECTED]) To: Declude.Virus@declude.com Sent: Wednesday, October 05, 2005 10:46 PM Subject: Re: [Declude.Virus] Possible new virus Alot got through

Re: [Declude.Virus] Possible new virus

2005-10-05 Thread Darrell \([EMAIL PROTECTED])
@declude.com Sent: Wednesday, October 05, 2005 10:46 PM Subject: Re: [Declude.Virus] Possible new virus Alot got through today with that one, but its being caught by F-Prot now. 10/05/2005 22:06:18 Q86937B8E01F27E50 MIME file: pword_change.zip [base64; Length=113709 Checksum=13075286

[Declude.Virus] Possible new virus?

2005-04-14 Thread John Tolmachoff \(Lists\)
I have seen in the last hour 4 e-mails blocked for [RAR-EXE] and each one had a blank subject line. Each one also had the recipients user part of the e-mail address as the sender's user part of the e-mail address. John T eServices For You --- This E-mail came from the Declude.Virus mailing

Re: [Declude.Virus] Possible new virus?

2005-04-14 Thread Scott Fisher
I had some today that fit this description. Mcafee found them as: the W32/[EMAIL PROTECTED] - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Thursday, April 14, 2005 4:19 PM Subject: [Declude.Virus] Possible new virus? I have

[Declude.Virus] Possible new virus?

2004-09-07 Thread John Tolmachoff \(Lists\)
I am seeing e-mail being caught with the Space Gap vulnerability. A user requested the file and upon investigating, it includes a scr or pif file. Declude Virus log is showing a jpg or gif image. The first line of the body is a link to the ad site yimg.com to gif or jpg images on that site.

[Declude.Virus] Possible New virus purporting to be from Symantec?

2004-07-27 Thread John Tolmachoff \(Lists\)
I just received two e-mails from Symantec which appear in every right to be legit. However, it contained 13 gif files and a zip file. Any one else seeing this? I did send one to virustrap. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses

Re: [Declude.Virus] Possible New virus purporting to be from Symantec?

2004-07-27 Thread R. Scott Perry
I just received two e-mails from Symantec which appear in every right to be legit. However, it contained 13 gif files and a zip file. Any one else seeing this? I did send one to virustrap. This is very odd. The E-mail definitely did come from Symantec. It did not, however, contain a virus.