Strange Virus Detected Messages

[Julian Field]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

 From the name "objdata" I would think it is an "Object Data" tag which
is also caught by MailScanner in the "Object Codebase" trap.

DNSAdmin wrote:

> At 04:04 PM 5/2/2005, you wrote:
>
>> Hi!
>>
>>> Report: F-Prot:
>>> /var/spool/MailScanner/incoming/4958/j42J8XdD005496/msg-4958-7.html
>>> Infection: HTML/ObjData at expl
>>>
>>> After querying users, it seems these messages could be false negatives.
>>>
>>> I am using both Clam AV and F-Prot - however ONLY F-Prot reports on
>>> this.
>>> (If I turn off F-Prot - no messages)
>>
>>
>> Most likely related to:
>>
>> 196     (first @ 19:01:16, last = 21:53:36)     Worm.Sober.P
>>
>> Started about the same time
>>
>> 2047    (first @ 19:06:47, last = 21:57:20)     HTML/ObjData at expl
>>
>>> I proceeded to update Clam AV to the latest version .84 and F-Prot to
>>> the latest 4.5.4. with the same result.
>>>
>>> Is this a MailScanner issue or is this a genuine Infection that F-Prot
>>> is seeing?
>>
>>
>> As far as we could tell, yes.
>>
>> Bye,
>> Raymond.
>
> Raymond.. as far as you could tell.. what? A genuine infection?
>
> I am seeing this too. It's almost as if something is attaching these
> .HTML
> attachments to valid mail.
>
> Thanks,
> Glenn
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> http://www.sng.ecs.soton.ac.uk/mailscanner/
> Configuration by Glenn Parsons dnsadmin-at-1bigthink.com
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!