oldmopar
01-31-2004, 10:13 AM
There is a new virus going around in case your are not aware some information is below
Basically if you receive this do not open the attachment
also at the bottom is a link to Nortons site with the whole story
The worm looks up the mail server that the recipient uses before sending the email. If it is unsuccessful, it will use the local mail server
instead. The email will have the following characteristics:
From: The "From" address may be spoofed.
Subject: The subject will be one of the following:
test
hi
hello
Mail Delivery System
Mail Transaction Failed
Server Report
Status
Error
Message: The message will be one of the following:
Mail transaction failed. Partial message is available.
The message contains Unicode characters and has been sent as a binary
attachment.
The message cannot be represented in 7-bit ASCII encoding and has been
sent as a binary attachment.
test
Attachment: The attachment file name, not including the extension,
will be one of the following:
document
readme
doc
text
file
data
test
message
body
The attached file may have either one or two file extensions. If it
does have two, the first extension will be one of the following:
.htm
.txt
.doc
The second extension, or the only extension if there is only one, will
be one of the following:
.pif
.scr
.exe
.cmd
.bat
.zip (This is an actual .zip file that contains a copy of the worm,
sharing the same file name as the .zip. For example, readme.zip can
contain readme.exe.)
http://securityresponse.symantec.com/avcenter/venc/data/w32.novarg.a@mm.html
Basically if you receive this do not open the attachment
also at the bottom is a link to Nortons site with the whole story
The worm looks up the mail server that the recipient uses before sending the email. If it is unsuccessful, it will use the local mail server
instead. The email will have the following characteristics:
From: The "From" address may be spoofed.
Subject: The subject will be one of the following:
test
hi
hello
Mail Delivery System
Mail Transaction Failed
Server Report
Status
Error
Message: The message will be one of the following:
Mail transaction failed. Partial message is available.
The message contains Unicode characters and has been sent as a binary
attachment.
The message cannot be represented in 7-bit ASCII encoding and has been
sent as a binary attachment.
test
Attachment: The attachment file name, not including the extension,
will be one of the following:
document
readme
doc
text
file
data
test
message
body
The attached file may have either one or two file extensions. If it
does have two, the first extension will be one of the following:
.htm
.txt
.doc
The second extension, or the only extension if there is only one, will
be one of the following:
.pif
.scr
.exe
.cmd
.bat
.zip (This is an actual .zip file that contains a copy of the worm,
sharing the same file name as the .zip. For example, readme.zip can
contain readme.exe.)
http://securityresponse.symantec.com/avcenter/venc/data/w32.novarg.a@mm.html