Spam/Trojan RTF

[Andrews Carl 455]

Nope, no examples. I was hoping someone on the list would have one.
Our firewall will stop any executable downloads, I just wanted to make
certain it did not come in with email.

Thanks!

-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Julian
Field
Sent: Wednesday, September 26, 2007 2:55 PM
To: MailScanner discussion
Subject: Re: Spam/Trojan RTF


Have you got any examples of it?
The 2nd document you link to here says that the RTF contains a link to 
an executable, not the executable itself, which makes more sense. It 
doesn't go into enough detail to infer anything else.

Andrews Carl 455 wrote:
> http://www.news.com/Trojan-attack-targets-top-executives/2100-7349_3-6
> 209930
>
<http://www.news.com/Trojan-attack-targets-top-executives/2100-7349_3-62
09930.html>.html 
>
<http://www.news.com/Trojan-attack-targets-top-executives/2100-7349_3-62
09930.html>
>
>      
>
http://www.darkreading.com/document.asp?doc_id=134229&WT.svl=news1_2
>     
> <http://www.darkreading.com/document.asp?doc_id=134229&WT.svl=news1_2>
>      
>      
>     Anyone have a sample of this  new(?) spam/trojan? Is the RTF
>     actually and executable or does it open in Office and run a macro;
>     can RTF's contain macros? If  I disallow executables will it be
>     blocked?
>      
>     Thanks!
>     Carl
>

Jules

-- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules at Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 For all
your IT requirements visit www.transtec.co.uk


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

-- 
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!