Problems since the new McAfee dat file 4252

[Andrew Hoying]

Here is a copy of the file h2DAmR5G020453.vir :

Return-Path: <g>
Received: from xx ([xx])
        by xx(8.12.8/8.12.8) with ESMTP id h2DAmR5G020453
        for <xx>; Thu, 13 Mar 2003 03:48:28 -0700
Full-Name: Yuriy Toropin
From: xx
To: xx
Subject: Meeting with representative from Vested Development Inc.
Date: Thu, 13 Mar 2003 13:52:30 +0300
Message-ID: <00b401c2e94e$a61aa480$d4e7a8c0 at mxpyuriy>
MIME-Version: 1.0
Content-Type: text/calendar; method=REQUEST;
        charset="utf-8"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.4024
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
Importance: Normal


Here is the output from uvscan:

# uvscan --recursive --ignore-links --analyze --secure --noboot
h2DAmR5G020453.vir
/root/h2DAmR5G020453.vir
        Found trojan or variant Exploit-CTCalendar !!!
        Please send a copy of the file to Network Associates


----- Original Message -----
From: "Julian Field" <mailscanner at ECS.SOTON.AC.UK>
To: <MAILSCANNER at JISCMAIL.AC.UK>
Sent: Thursday, March 13, 2003 3:14 AM
Subject: Re: Problems since the new McAfee dat file 4252


> At 22:49 12/03/2003, you wrote:
> >I know I'm running a very old version of mailscanner, 3.14, which may be
> >the problem, but since the new dat file came out, Office XP calendar
> >meeting requests are being reported as Exploit-CTCalendar and then the
> >scanner crashes and reports the virus again, 50-60 times a minute until I
> >delete the message from the incoming folder. Is there anything I can do,
> >short of upgrading the a new version, to fix this problem?
>
> What happens when you run mcafee on the files by hand? Can you mail me the
> exact output please, and I'll find out what new versions do with it.
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>