Security Incidents mailing list archives
Virus sig?
From: "John R. Sciandra" <johnrs () NACON COM>
Date: Thu, 22 Mar 2001 04:51:29 -0800
I got this question from another mailing list and thought it might be interesting to see if anyone knows about this: [One of our users received a message with an attachment identified as: 'RE Fwd Fwd Fwd Fwd Fwd SEND THIS BACK.msg' User did not open the attachment but had preview active (outlook client). Shortly after viewing this message, user's inbox began filling with copies of the original message and the attached message in pairs every 3 minutes or so. So far up to 1000 messages..... No other accounts are involved. Not recognized by any of the current AV signature files. No messages are leaving the workstation. No office assistant rules are defined. Any one heard of anything like this?] John R. Sciandra, CISSP NACON Consulting, LLC
Current thread:
- "closed-port" backdoors Andreas Hasenack (Mar 21)
- Virus sig? John R. Sciandra (Mar 22)
- Re: "closed-port" backdoors Alexander Reelsen (Mar 22)
- Re: "closed-port" backdoors Fernando Cardoso (Mar 22)
- Re: "closed-port" backdoors Valdis Kletnieks (Mar 22)
- Re: "closed-port" backdoors Andreas Hasenack (Mar 22)
- Re: "closed-port" backdoors Joe Boyle (Mar 22)
- <Possible follow-ups>
- Re: "closed-port" backdoors Frank Knobbe (Mar 22)
- Re: "closed-port" backdoors Andreas Hasenack (Mar 22)
- Re: "closed-port" backdoors M ixter (Mar 23)