Virus? Trojan?

From: David Gillett (gillettdavid@fhda.edu)
Date: 12/30/02

  • Next message: Peter Kruse: "Re: Virus? Trojan?" 
    From: "David Gillett" <gillettdavid@fhda.edu>
To: "'Incidents List'" <incidents@securityfocus.com>
Date: Mon, 30 Dec 2002 14:03:18 -0800

      So far today, I've received two email messages from

    kbl-zrz2519.zeelandnet.nl [62.238.233.233]

    which, apparently, claimed in its HELO message to *be*
    our local MX (which of course was who it was talking TO).
    Sounds to me like a bug in the sending software.

      The other thing these messages had in common was a
    33KB .scr ("screen saver") executable attachment.
    Norton doesn't recognize this as a known threat, but
    I don't want to be the first to learn the hard way what
    it does.

      MAYBE this is just ill-conceived and poorly-written
    spam. Maybe it's something more serious. Anybody know
    one way or the other?

    David Gillett

    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management
    and tracking system please see: http://aris.securityfocus.com

    Relevant Pages

    • Re: Virus? Trojan?
      ... On Mon, 30 Dec 2002, David Gillett wrote: ... I've received two email messages from ... > which, apparently, claimed in its HELO message to *be* ... > Norton doesn't recognize this as a known threat, ...
      (Incidents)
    • Re: Errors but no Error Codes?
      ... Settings pertaining to newsgroups have no effect on the ability ... to receive email messages. ... Norton was supposed to be, ...
      (microsoft.public.windows.vista.mail)
    • email problems
      ... Currently using employers exchange server 5.5 as a remote ... I can receive the email messages ... Norton said it is a Microsoft problem and Microsoft said ...
      (microsoft.public.exchange.misc)