{Virus?} Re:look,my beautiful girl friend

mailscanner mailscanner at ecs.soton.ac.uk
Wed Jul 16 14:30:39 IST 2003


Warning: This message has had one or more attachments removed
Warning: (click.bat, msg-1771660-28.html).
Warning: Please read the "VirusWarning.txt" attachment(s) for more information.


-------------- next part --------------
This is a message from the MailScanner E-Mail Virus Protection Service
----------------------------------------------------------------------
The original e-mail attachment "msg-1771660-28.html"
was believed to be infected by a virus and has been replaced by this warning
message.

If you wish to receive a copy of the *infected* attachment, please
e-mail helpdesk and include the whole of this message
in your request. Alternatively, you can call them, with
the contents of this message to hand when you call.

At Wed Jul 16 09:31:16 2003 the virus scanner said:
   Found dangerous IFrame tag in HTML message

Note to Help Desk: Look on the MailScanner in /d/MailScanner/quarantine/20030716 (message 19cmMh-004KOX-00).
-- 
Postmaster
Mailscanner thanks transtec Computers for their support
-------------- next part --------------
This is a message from the MailScanner E-Mail Virus Protection Service
----------------------------------------------------------------------
The original e-mail attachment "click.bat"
was believed to be infected by a virus and has been replaced by this warning
message.

If you wish to receive a copy of the *infected* attachment, please
e-mail helpdesk and include the whole of this message
in your request. Alternatively, you can call them, with
the contents of this message to hand when you call.

At Wed Jul 16 09:31:17 2003 the virus scanner said:
   >>> Virus 'W32/Klez-H' found in file click.bat
   Batch files are often mailicious (click.bat)

Note to Help Desk: Look on the MailScanner in /d/MailScanner/quarantine/20030716 (message 19cmMh-004KOX-00).
-- 
Postmaster
Mailscanner thanks transtec Computers for their support
-------------- next part --------------
Content-Type: application/octet-stream;
	name=misc[1].htm
Content-Transfer-Encoding: base64
Content-ID: <SvNNIc4yM>

Ly8gSmF2YXNjcmlwdCBVdGlsaXRpZXMKLy8gTmV0TGFicy5uZXQgIEFsbCBSaWdodHMgUmVz
ZXJ2ZWQsIGluZm9AbmV0bGFicy5uZXQgQ29weXJpZ2h0IDIwMDIKLy8KCk5TNCA9IChkb2N1
bWVudC5sYXllcnMpID8gdHJ1ZSA6IGZhbHNlOwpJRSA9IChkb2N1bWVudC5hbGwpID8gdHJ1
ZSA6IGZhbHNlOwpJRTQgPSAoKGRvY3VtZW50LmFsbCkmJihuYXZpZ2F0b3IuYXBwVmVyc2lv
bi5pbmRleE9mKCJNU0lFIDQuIikhPS0xKSkgPyB0cnVlIDogZmFsc2U7CklFNSA9ICgoZG9j
dW1lbnQuYWxsKSYmKG5hdmlnYXRvci5hcHBWZXJzaW9uLmluZGV4T2YoIk1TSUUgNS4iKSE9
LTEpKSA/IHRydWUgOiBmYWxzZTsKSUU2ID0gKChkb2N1bWVudC5hbGwpJiYobmF2aWdhdG9y
LmFwcFZlcnNpb24uaW5kZXhPZigiTVNJRSA2LiIpIT0tMSkpID8gdHJ1ZSA6IGZhbHNlOwp2
ZXI0ID0gKE5TNCB8fCBJRTQpID8gdHJ1ZSA6IGZhbHNlOwpOUzYgPSAoZG9jdW1lbnQuZ2V0
RWxlbWVudEJ5SWQpICYmIChuYXZpZ2F0b3IudXNlckFnZW50LmluZGV4T2YoJ05ldHNjYXBl
JykhPS0xKT90cnVlOmZhbHNlOwpJRTVwbHVzID0gSUU1IHx8IElFNjsKREhUTUw9IChOUzQg
fHwgSUUgfHwgTlM2KTsKCgpmdW5jdGlvbiBnZXRPYmoobmFtZSkKewogIGlmIChkb2N1bWVu
dC5hbGwpCiAgeyByZXR1cm4gZG9jdW1lbnQuYWxsW25hbWVdIH0KICBlbHNlIGlmIChkb2N1
bWVudC5nZXRFbGVtZW50QnlJZCkKICB7IHJldHVybiBkb2N1bWVudC5nZXRFbGVtZW50QnlJ
ZChuYW1lKSB9CiAgZWxzZSBpZiAoZG9jdW1lbnQubGF5ZXJzKQogIHsgcmV0dXJuIGRvY3Vt
ZW50LmxheWVyc1tuYW1lXTsgfQogIGVsc2UgcmV0dXJuIGZhbHNlOwp9CgoKCmZ1bmN0aW9u
IGFyck9uKG51bSkgewogICBpZiAoIURIVE1MICkgcmV0dXJuOwogICBlPWdldE9iaignYXJy
JytudW0pOwogICBpZiAoIWUgKSByZXR1cm47CiAgIGUuc3JjID0gIi9pbWFnZXMvbG4tZ3JB
cnJEb3duLmdpZiI7CiAgIGU9Z2V0T2JqKCdsbicrbnVtKTsKICAgaWYgKCFlICkgcmV0dXJu
OwogICBlLnNyYyA9ICIvaW1hZ2VzLzY2OTk2NnB4LmdpZiI7CiAgIC8vZS5zdHlsZS52aXNp
YmlsaXR5PSJ2aXNpYmxlIjsKfQoKCmZ1bmN0aW9uIGFyck9mZihudW0pIHsKICAgaWYgKCFE
SFRNTCApIHJldHVybjsKICAgZT1nZXRPYmooJ2FycicrbnVtKTsKICAgaWYgKCFlICkgcmV0
dXJuOwogICBlLnNyYyA9ICIvaW1hZ2VzL2xuLWJsdUFyclJ0LmdpZiI7CiAgIGU9Z2V0T2Jq
KCdsbicrbnVtKTsKICAgaWYgKCFlICkgcmV0dXJuOwogICBlLnNyYyA9ICIvaW1hZ2VzL3Ry
YW5zcHguZ2lmIjsKICAgLy9lLnN0eWxlLnZpc2liaWxpdHk9ImhpZGRlbiI7Cn0KCgoKZnVu
Y3Rpb24gc3dhcEltYWdlKCkgeyAKICB2YXIgaSwgdGhlT2JqLCBqPTAsIHN3YXBBcnJheT1u
ZXcgQXJyYXksIG9sZEFycmF5PWRvY3VtZW50LnN3YXBJbWdEYXRhOyAgCiAgZm9yIChpPTA7
IGkgPCAoc3dhcEltYWdlLmFyZ3VtZW50cy5sZW5ndGgtMik7IGkrPTMpIHsgIAogICAgdGhl
T2JqID0gZXZhbChzd2FwSW1hZ2UuYXJndW1lbnRzWyhuYXZpZ2F0b3IuYXBwTmFtZSA9PSAn
TmV0c2NhcGUnKT9pOmkrMV0pICAKICAgIGlmICh0aGVPYmogIT0gbnVsbCkgeyAgCiAgICAg
IHN3YXBBcnJheVtqKytdID0gdGhlT2JqOyAgCiAgICAgIHN3YXBBcnJheVtqKytdID0gKG9s
ZEFycmF5PT1udWxsIHx8IG9sZEFycmF5W2otMV0hPXRoZU9iaik/dGhlT2JqLnNyYzpvbGRB
cnJheVtqXTsgIAogICAgICB0aGVPYmouc3JjID0gc3dhcEltYWdlLmFyZ3VtZW50c1tpKzJd
OyAgCiAgfSB9ICAKICBkb2N1bWVudC5zd2FwSW1nRGF0YSA9IHN3YXBBcnJheTsgLy91c2Vk
IGZvciByZXN0b3JlICAKfSAgCgpmdW5jdGlvbiBzd2FwSW1nUmVzdG9yZSgpIHsgCiAgaWYg
KGRvY3VtZW50LnN3YXBJbWdEYXRhICE9IG51bGwpICAKICAgIGZvciAodmFyIGk9MDsgaTwo
ZG9jdW1lbnQuc3dhcEltZ0RhdGEubGVuZ3RoLTEpOyBpKz0yKSAgCiAgICAgIGRvY3VtZW50
LnN3YXBJbWdEYXRhW2ldLnNyYyA9IGRvY3VtZW50LnN3YXBJbWdEYXRhW2krMV07ICAKfSAg
CgoKcGFnZT13aW5kb3cubG9jYXRpb247CmZ1bmN0aW9uIHNlbmRfbWFpbCgpCnsKdGl0bGU9
ZG9jdW1lbnQudGl0bGU7CmJvZHk9IlRha2UgYSBsb29rIGF0IHRoaXMlMEQlMEEiK3RpdGxl
KyIlMEQlMEEiK3BhZ2U7Cgptc2c9Im1haWx0bzo/c3ViamVjdD0iK3RpdGxlKyImYm9keT0i
K2JvZHk7CgovLyBhbGVydChtc2cpCndpbmRvdy5sb2NhdGlvbj1tc2c7Cgp9CgoKCgpmdW5j
dGlvbiBvcGVuV2luICggaHRtbEZpbGUsIGZpbGVIZWlnaHQsIGZpbGVXaWR0aCApCnsKCiAg
V2luUHJvY2Vzcz13aW5kb3cub3BlbiggaHRtbEZpbGUgLCAnX2JsYW5rJywic2Nyb2xsYmFy
cz15ZXMscmVzaXphYmxlPXllcyxoZWlnaHQ9IitmaWxlSGVpZ2h0KyIsd2lkdGg9IitmaWxl
V2lkdGgpIAogIFdpblByb2Nlc3MuZm9jdXMoKTsKfQoKZnVuY3Rpb24gb3Blbldpbk5TICgg
aHRtbEZpbGUsIGZpbGVIZWlnaHQsIGZpbGVXaWR0aCApCnsKICBXaW5Qcm9jZXNzPXdpbmRv
dy5vcGVuKCBodG1sRmlsZSAsICdfYmxhbmsnLCJzY3JvbGxiYXJzPW5vLHJlc2l6YWJsZT15
ZXMsaGVpZ2h0PSIrZmlsZUhlaWdodCsiLHdpZHRoPSIrZmlsZVdpZHRoKSAKICBXaW5Qcm9j
ZXNzLmZvY3VzOwp9CgoKCmZ1bmN0aW9uIG9wZW5QSShwaSkKewogIHBpV2luPXdpbmRvdy5v
cGVuKCBwaSwgJ19ibGFuaycsJ3Njcm9sbGJhcnM9eWVzLHJlc2l6YWJsZT15ZXMsaGVpZ2h0
PTYwMCx3aWR0aD02MDAnKTsKICBwaVdpbi5mb2N1cygpOwp9CgoKZnVuY3Rpb24gaW50ZXJz
dGl0KCBwYWdlICkgewogdmFyIHJldDsKCiAgJG1zZz0nWW91IGFyZSBub3cgbGVhdmluZyB0
aGUgd3d3LnBoYXJtYS51cy5ub3ZhcnRpcy5jb20gc2l0ZSBhbmQgbW92aW5nIHRvIGFuIGV4
dGVybmFsIFdlYiBzaXRlIGluZGVwZW5kZW50bHkgb3BlcmF0ZWQgYW5kIG5vdCBtYW5hZ2Vk
IGJ5IHRoZSBOb3ZhcnRpcyBQaGFybWFjZXV0aWNhbHMgQ29ycG9yYXRpb24uIE5vdmFydGlz
IGFzc3VtZXMgbm8gcmVzcG9uc2liaWxpdHkgZm9yIHRoZSBzaXRlLlxuXG4gSWYgeW91IGRv
IG5vdCB3aXNoIHRvIGxlYXZlIHRoaXMgc2l0ZSwgY2xpY2sgQ2FuY2VsLiAgT3IsIGNsaWNr
IE9LIHRvIGNvbnRpbnVlLiAnOwoKICByZXQ9Y29uZmlybSgkbXNnKTsKCmlmICggcmV0ICkK
ICB7CiAgICAgIHdpbmRvdy5vcGVuKHBhZ2UpCiAgICAgIC8vd2luZG93LmxvY2F0aW9uLmhy
ZWY9cGFnZTsKICB9Cgp9CgoKLy8gRW5kIE5ldExhYnMgSmF2YXNjcmlwdCBGdW5jdGlvbnMK
Ly8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLwoK
Cj==


More information about the MailScanner mailing list