Antivir founds a new Trojan..other virus-scanners do not

[Marcel Blenkers]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi there,



On Wed, 17 Nov 2004, Jan-Peter Koopmann wrote:

> > just for you all to know..
> >
> > there is a new Trojan in Germany spreading around..
> >
> > It is called
> >
> > TR/Pish.Telekom.A
>
> Yep. Unfortunatly thats very true. We had problems with this as well.
> Please note though that the mail itself does not contain the Trojan. It
> is a Phishing-Style mail that requests the user to open a link. If you
> do in IE the webpage uses some "old" IE vulnerabilities to download the
> trojan in the background. Local virus scanners detect that vulnerability
> (Microsoft VM problem), at least eTrust did here.

Yes..it is a html-mail, opening a frame, which then installs the trojan.


>
> So technically it is "ok" for the other virus scanners not to detect
> this, since it is "only" a mail message....

But some users do use a webinterface via IE..and this would get very
boring..as only Antivir and Sophos seems to know this stuff.. :(

Haven´t tried on my Windows-Maschine with AVG or Norton..maybe i shoud
start this OS again ;)

Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!