Antivir founds a new Trojan..other virus-scanners do not

Jan-Peter Koopmann Jan-Peter.Koopmann at SECEIDOS.DE
Wed Nov 17 14:40:58 GMT 2004


    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> just for you all to know..
> 
> there is a new Trojan in Germany spreading around..
> 
> It is called
> 
> TR/Pish.Telekom.A

Yep. Unfortunatly thats very true. We had problems with this as well. Please note though that the mail itself does not contain the Trojan. It is a Phishing-Style mail that requests the user to open a link. If you do in IE the webpage uses some "old" IE vulnerabilities to download the trojan in the background. Local virus scanners detect that vulnerability (Microsoft VM problem), at least eTrust did here. 

So technically it is "ok" for the other virus scanners not to detect this, since it is "only" a mail message....

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!




More information about the MailScanner mailing list