bill.zip?

[Mike Kercher]

Apr 28 21:47:10 avwall MailScanner[16624]: INFECTED:: W32/Netsky-P
W32/Netsky-P:: ./i3T2l18o026083/bill.zip
Apr 28 21:47:10 avwall MailScanner[16624]: INFECTED:: Worm.SomeFool.P::
./i3T2l18o026083/bill.zip

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Remco Barendse
> Sent: Thursday, April 29, 2004 1:58 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: bill.zip?
>
> Is anyone else receiving mails with an attachment bill.zip?
>
> The attachment is extremely small and I know for sure that it
> is not legitimate mail. Neither clam nor McAfee picked it up.
>
> This is what the df/qf pair contains:
>
> This is a multi-part message in MIME format.
>
> ------=_NextPart_000_0002_00000AA8.00001F69
> Content-Type: text/plain;
>         charset="Windows-1252"
> Content-Transfer-Encoding: 7bit
>
> Important bill!
>
>
> ------=_NextPart_000_0002_00000AA8.00001F69
> Content-Type: application/octet-stream;
>         name="Bill.zip"
> Content-Transfer-Encoding: base64
> Content-Disposition: attachment;
>         filename="Bill.zip"
>
> UEsFBgAAAAAAAAAAAAAAAAAAAAAAAA==
> ------=_NextPart_000_0002_00000AA8.00001F69--
>
> -------------------------- MailScanner list ----------------------
> To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
> For further info about MailScanner, please see the Most Asked
> Questions at    http://www.mailscanner.biz/maq/     and the archives
> at    http://www.jiscmail.ac.uk/lists/mailscanner.html
>

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
For further info about MailScanner, please see the Most Asked
Questions at    http://www.mailscanner.biz/maq/     and the archives
at    http://www.jiscmail.ac.uk/lists/mailscanner.html