New Virus with Fake Microsoft Address...

[Ulysees]

Is there already a damaged version of this doing the rounds or are both
SophosSavi & ClamAv not detecting it right ?
I recieved a mail like this earlier with an attachment of Q841428.exe the
virus scanners don't have any issue with it (glad .exes are blocked)
md5sum on the file is b09e26c292759d654633d3c8ed00d18d
if someone could compare to a known bad copy I'd appreciate it.

Uly

----- Original Message -----
From: "Forrest Aldrich" <forrie at FORRIE.COM>
To: <MAILSCANNER at JISCMAIL.AC.UK>
Sent: Friday, September 19, 2003 7:38 AM
Subject: [MAILSCANNER] New Virus with Fake Microsoft Address...


> This new virus appears to generate many (random?) subjects, so it's
getting
> difficult to narrow down.
>
> Has anyone filters for Spamassassin that will correctly identify this
> virus?  I'd like to score this one high so they are rejected (via
> spamass-milter)... it's been a huge problem all day.
>
> The fake messages have a preamble like this:
>
>  >>>>>>>>>
> MS User
>
> this is the latest version of security update, the "September 2003,
> Cumulative Patch" update which eliminates all known security
> vulnerabilities affecting MS Internet Explorer, MS Outlook and MS Outlook
> Express as well as three newly discovered vulnerabilities. Install now to
> continue keeping your computer secure from these vulnerabilities. This
> update includes the functionality of all previously released patches.
> <<<<<<<<<
>
>
>
> Thanks,
> Forrest
>