Svar: Re: New Virus Worm.SomeFool.P or Netsky.q/p

[Jan Elmqvist Nielsen]

Kaspersky and f-prot dos detect some

here here is kaspersky scan:
Current object: 20040322/i2MEs9B13354
/var/spool/MailScanner/quarantine/20040322/i2MEs9B13354/message
archive: Mail
/var/spool/MailScanner/quarantine/20040322/i2MEs9B13354/message/[From
sandra.zogg at lasuisse.ch][Date Mon, 22 Mar 2004 16:00:11
+0100]/UNNAMED ok.
/var/spool/MailScanner/quarantine/20040322/i2MEs9B13354/message/[From
sandra.zogg at lasuisse.ch][Date Mon, 22 Mar 2004 16:00:11 +0100]/text
ok.
/var/spool/MailScanner/quarantine/20040322/i2MEs9B13354/message/[From
sandra.zogg at lasuisse.ch][Date Mon, 22 Mar 2004 16:00:11
+0100]/document_with_notice.pif packed: PE_Patch
/var/spool/MailScanner/quarantine/20040322/i2MEs9B13354/message/[From
sandra.zogg at lasuisse.ch][Date Mon, 22 Mar 2004 16:00:11
+0100]/document_with_notice.pif packed: FSG
/var/spool/MailScanner/quarantine/20040322/i2MEs9B13354/message/[From
sandra.zogg at lasuisse.ch][Date Mon, 22 Mar 2004 16:00:11
+0100]/document_with_notice.pif FSG: unknown format.
/var/spool/MailScanner/quarantine/20040322/i2MEs9B13354/document_with_notice.pif
packed: PE_Patch
/var/spool/MailScanner/quarantine/20040322/i2MEs9B13354/document_with_notice.pif
packed: FSG
/var/spool/MailScanner/quarantine/20040322/i2MEs9B13354/document_with_notice.pif
FSG: unknown format.

/Jan Elmqvist Nielsen

>>> max.gaspari at MERCATONEUNO.IT 22-03-2004 16:44:41 >>>
Hi

We have received many mail with this Virus, and KAV Found it..

ClamAV: product.scr contains Worm.SomeFool.P
Kaspersky:
/var/spool/MailScanner/incoming/13631/1B5RFv-0004yt-C9/product.scr
INFECTED I-Worm.Netsky.q

But Kaspersky is 5.0.2 version
Bye

-----Original Message-----
From: Jan Elmqvist Nielsen [mailto:JEN at AH.DK]
Sent: Monday, March 22, 2004 4:40 PM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: New Virus Worm.SomeFool.P or Netsky.q/p


Hi

I have received a mail which contains a the new Virus Worm.SomeFool.P
or
Netsky.q/p but the only scanner which detected it was Clamav and
Mailscanner!

Virus report

ClamAV: document_with_notice.pif contains Worm.SomeFool.P MailScanner:
Shortcuts to MS-Dos programs are very dangerous in email
(document_with_notice.pif)
No programs allowed (document_with_notice.pif)

Nor f-prot (4.4.1) or kaspersky 4.0 detected the virus

I have run manuelt scan, with the some result

/Jan Elmqvist Nielsen