<html><body bgcolor="#FFFFFF"><div>I'm not affected since I use sendmail, but if you guys post a brief howto regarding submitting samples I'll be glad to help. <br><br>---<div><br></div><div>Alex Neuman</div><div>Reliant Technologies</div><div>+507 6781-9505</div><div>Skype: alexneuman</div></div><div><br>On Sep 15, 2008, at 7:26 AM, Andreas Kasenides <<a href="mailto:Andreas.Kasenides@cs.ucy.ac.cy">Andreas.Kasenides@cs.ucy.ac.cy</a>> wrote:<br><br></div><div></div><blockquote type="cite"><div>
Julian Field wrote:
<blockquote cite="mid:48CE134C.7080307@ecs.soton.ac.uk" type="cite">As
some of you may have already realised, a few people are having a
problem on particular OS's when using Postfix, where a message
generated by a particular Trojan are not being unpacked properly.
<br>
<br>
So Postfix users on CentOS, please can you check your logs for any
16-17Kb spams which could possibly containing an attachment called
"start.zip" (grep should find it in raw queue files, if you're
wondering how to do that for raw queue files), which have not always
been detected as infected.
<br>
<br>
You might want to use the "Archive Mail" feature of MailScanner.conf
for a while to see if you're getting anything like that, in case you
are suffering the problem.
<br>
<br>
We would very much like to know how widespread this problem is, so
please report back with your findings and we'll take a straw poll of
the respondents.
<br>
<br>
Thanks folks!
<br>
<br>
Jules
<br>
<br>
</blockquote>
<font face="Helvetica, Arial, sans-serif">Running MS 4.71.10 with
Postfix 2.3.3 and CentOS 5.2.<br>
Many of these, actually 79 in the last 36 hours or so have been caught
successfully.<br>
<br>
Sep 14 07:25:25 iolaos-new MailScanner[16162]:
/var/spool/MailScanner/incoming/16162/./DC59F8C275.169EC/start.zip:
Trojan.Fakealert-532 FOUND<br>
Sep 14 07:25:29 iolaos-new MailScanner[15957]:
/var/spool/MailScanner/incoming/15957/./C8E378C2A5.BBD68/start.zip:
Trojan.Fakealert-532 FOUND<br>
Sep 14 07:26:05 iolaos-new MailScanner[15906]:
/var/spool/MailScanner/incoming/15906/./6C6408C2A7.5DEC0/start.zip:
Trojan.Fakealert-532 FOUND<br>
Sep 14 07:30:16 iolaos-new MailScanner[16162]:
/var/spool/MailScanner/incoming/16162/./C5C768C2AA.09A93/start.zip:
Trojan.Fakealert-532 FOUND<br>
.......<br>
cat maillog|grep DC59F8C275.169EC<br>
Sep 14 07:25:25 iolaos-new MailScanner[16162]:
/var/spool/MailScanner/incoming/16162/./DC59F8C275.169EC/start.zip:
Trojan.Fakealert-532 FOUND<br>
Sep 14 07:25:25 iolaos-new MailScanner[16162]:
/var/spool/MailScanner/incoming/16162/./DC59F8C275.169EC/Start.exe:
Trojan.Fakealert-532 FOUND<br>
Sep 14 07:25:25 iolaos-new MailScanner[16162]: Infected message
DC59F8C275.169EC came from 83.206.158.181<br>
Sep 14 07:25:25 iolaos-new MailScanner[16162]: Filename Checks:
(DC59F8C275.169EC Start.exe)<br>
<br>
<br>
Andreas<br>
</font>
</div></blockquote><blockquote type="cite"><div><span>-- </span><br><span>MailScanner mailing list</span><br><span><a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a></span><br><span><a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a></span><br><span></span><br><span>Before posting, read <a href="http://wiki.mailscanner.info/posting"><a href="http://wiki.mailscanner.info/posting">http://wiki.mailscanner.info/posting</a></a></span><br><span></span><br><span>Support MailScanner development - buy the book off the website! </span><br></div></blockquote></body></html>