Security Incidents mailing list archives

Virus sig?


From: "John R. Sciandra" <johnrs () NACON COM>
Date: Thu, 22 Mar 2001 04:51:29 -0800

I got this question from another mailing list and thought it might be
interesting to see if anyone knows about this:

[One of our users received a message with an attachment identified as:

       'RE Fwd Fwd Fwd Fwd Fwd SEND THIS BACK.msg'

User did not open the attachment but had preview active (outlook client).

Shortly after viewing this message, user's inbox began filling with copies
of the original message and the attached message in pairs every 3 minutes or
so. So far up to 1000 messages.....

No other accounts are involved.

Not recognized by any of the current AV signature files.

No messages are leaving the workstation.

No office assistant rules are defined.

Any one heard of anything like this?]

John R. Sciandra, CISSP
NACON Consulting, LLC


Current thread: