Some Worm is trying to cheat MailScanner users ?!

[Moacyr Leite da Silva]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Brazilian ;-)

Yes, the filename rules blocked the .scr file

I sent the email FYI because didnt have information about this kind of worm
until yesterday. And was concerned that this can lead someone to open some
attachments.

Thanks
Moacyr




----- Original Message ----- 
From: "Drew Marshall" <drew at THEMARSHALLS.CO.UK>
To: <MAILSCANNER at JISCMAIL.AC.UK>
Sent: Thursday, January 06, 2005 10:19 AM
Subject: Re: Some Worm is trying to cheat MailScanner users ?!


Moacyr Leite da Silva wrote:
>> Seens to me that some worm is trying to cheat MailScanner users, I dont
>> have
>> signature in my MailScanner configurations.

No the virus was removed. I'm not a Spanish (Or Brazillian!) speaker so I
can't tell you what it says but I see a Mailscanner warning message in the
headers.

>>
>> Warning: Esta mensagem continha anexos que foram removidos
>> Warning: (thats_hard.9727.scr).
>> Warning: Leia o anexo "AKADNYX-Attachment-Warning.txt" para maiores
>> informações.
>>
>> I was surprised, too!
>> Who_could_suspect_something_like_that? shityiiiii
>>
>>
>>
>> *-*-* Mail_Scanner: No Virus
>> *-*-* AKADNYX.COM- Anti_Virus Service
>> *-*-* http://www.akadnyx.com.br
>>
>> --===a2d635d06.48886b1bbe8731095
>> Content-Type: text/plain;
>>  charset="us-ascii";
>>  name="AKADNYX-Attachment-Warning.txt"
>> Content-Disposition: attachment;
>> filename="AKADNYX-Attachment-Warning.txt"
>> Content-Transfer-Encoding: quoted-printable
>>
>> Esta =E9 uma mensagem do servi=E7o de prote=E7=E3o contra v=EDrus
>> ----------------------------------------------------------------------
>> O anexo "thats_hard.9727.scr" encontra-se na lista pro=EDbida de tipos
>> de a> rquivo,
>> e foi substitu=EDdo por esta mensagem de aviso no e-mail.
>>
>> Nossos sistemas previnem que uma c=F3pia do arquivo em quest=E3o fique
>> armazenada.
>>
>> Hoje, Wed Jan  5 03:16:21 2005, o anti-virus relatou o seguinte:
>>    Windows Screensavers are often used to hide viruses
>> (thats_hard.9727.scr)
>>    No programs allowed (thats_hard.9727.scr)
>>
>> --=20
>> Postmaster

I agree that your AV seems not to have found a virus but MS has removed
the attachment anyway. Perhaps the attachment was broken...

Drew


-- 
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!