New Trojan

[Paul Hutchings]

It's been morphing quite a lot.  We noticed it coming in yesterday, the Trend on our Exchange ignored it as did Clam on MailScanner, various other engines did find it, each giving it a different name, and it's been a similar pattern for the last day or so with it morphing.

It's been an interesting experience for me actually as one of our renewals is up in a month or two and seeing the response times of various vendors has been an education.

Cheers,

Paul

Paul Hutchings
Network Administrator, MIRA Ltd.
Tel: 44 (0)24 7635 5378
Fax: 44 (0)24 7635 8378
mailto:paul.hutchings at mira.co.uk

-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Anthony Cartmell
Sent: 24 July 2008 15:59
To: MailScanner discussion
Subject: Re: New Trojan

>> Not according to VirusTotal!
>>  ClamAV, Microsoft, and VBA32 are the only ones which dtect my sample.
>
> OK, it may have morphed, but Sophos has been detecting something in the  
> UPS invoice zip files, which clamav didn't since the weekend.

It seems to be morphing quite a bit, and clamav has had several more  
updates: I'm seeing 7814 at the mo.

Anthony
-- 
www.fonant.com - Quality web sites
-- 
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 

-- 
MIRA Ltd

Watling Street, Nuneaton, Warwickshire, CV10 0TU, England.

Registered in England and Wales No. 402570
VAT Registration  GB 114 5409 96

The contents of this e-mail are confidential and are solely for the use of the intended recipient.
If you receive this e-mail in error, please delete it and notify us either by e-mail, telephone or fax.
You should not copy, forward or otherwise disclose the content of the e-mail as this is prohibited.