Antivir founds a new Trojan..other virus-scanners do not

Marcel Blenkers marcel-ml at IRC-ADDICTS.DE
Wed Nov 17 16:01:43 GMT 2004

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi there,

On Wed, 17 Nov 2004, Jan-Peter Koopmann wrote:

> > just for you all to know..
> >
> > there is a new Trojan in Germany spreading around..
> >
> > It is called
> >
> > TR/Pish.Telekom.A
> Yep. Unfortunatly thats very true. We had problems with this as well.
> Please note though that the mail itself does not contain the Trojan. It
> is a Phishing-Style mail that requests the user to open a link. If you
> do in IE the webpage uses some "old" IE vulnerabilities to download the
> trojan in the background. Local virus scanners detect that vulnerability
> (Microsoft VM problem), at least eTrust did here. is a html-mail, opening a frame, which then installs the trojan.

> So technically it is "ok" for the other virus scanners not to detect
> this, since it is "only" a mail message....

But some users do use a webinterface via IE..and this would get very only Antivir and Sophos seems to know this stuff.. :(

Haven´t tried on my Windows-Maschine with AVG or Norton..maybe i shoud
start this OS again ;)



------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ ( and
the archives (

Support MailScanner development - buy the book off the website!

More information about the MailScanner mailing list