interfree.it virus?
Hanan Cohen
In the last days, I keep getting email messages from people I am on
their address books. It's a message with no subject with the following
HTML code. I am using Yahoo! Mail so maybe attachements are filtered on
the way.
Is there a virus that generated this message?
<html>
<head>
<title>Untitled Document</title>
<meta http-equiv="Content-Type" content="text/html;
charset=iso-8859-1">
<meta http-equiv="WindowTarget" content="_top">
</head>
<frameset rows="40,*" frameborder="NO" border="0" framespacing="0">
<frame name="topFrame" scrolling="NO" noresize src="frame_up.shtml" >
<frame name="mainFrame" scrolling="YES" src="http://www.interfree.it"
target="_new">
</frameset>
<noframes>
<body bgcolor="#FFFFFF" text="#000000">
</body>
</noframes>
</html>
Roland Garcia
> Hello
>
> In the last days, I keep getting email messages from people I am on
> their address books. It's a message with no subject with the following
> HTML code. I am using Yahoo! Mail so maybe attachements are filtered on
> the way.
>
> Is there a virus that generated this message?
>
> <html>
> <head>
> <title>Untitled Document</title>
> <meta http-equiv="Content-Type" content="text/html;
etc.....
That is clean HTML.
Roland Garcia
Frank
One of our managers was on holidays since 20/12 so his virus
protection wasn't updated so this little virus got in
http://www.sarc.com/avcenter/venc/data/w32....@mm.html during the
small window of opportunity between him starting his computer auto
starting his e-mail and his virus definitions being updated.
Ran a Virus scan and it found the virus in his windows/temp directory.
Good luck
frank
Hanan Cohen <hanan...@yahoo.com> wrote in message news:<3C2F2ED0...@yahoo.com>...
Roland Garcia
> Hello
>
> In the last days, I keep getting email messages from people I am on
> their address books. It's a message with no subject with the following
> HTML code. I am using Yahoo! Mail so maybe attachements are filtered on
> the way.
>
> Is there a virus that generated this message?
>
> <html>
> <head>
> <title>Untitled Document</title>
> <meta http-equiv="Content-Type" content="text/html;
etc.....
That is clean HTML.
Roland Garcia
========= WAS CANCELLED BY =======:
Path: news.sol.net!spool1-nwblwi.newsops.execpc.com!newsfeeds.sol.net!news-out.visi.com!hermes.visi.com!uunet!ash.uu.net!sac.uu.net!lax.uu.net!news.navix.net!u-n-c-a-n-c-e-l-l-e-r
From: Roland Garcia <roland...@worldnet.fr>
Newsgroups: opera.test,comp.lang.c,alt.comp.virus
Subject: cmsg cancel <3C2F3312...@worldnet.fr>
Control: cancel <3C2F3312...@worldnet.fr>
Date: Mon, 31 Dec 2001 04:21:53 GMT
Organization: Navix Internet Subscribers
Lines: 2
Message-ID: <cancel.3C2F3...@worldnet.fr>
NNTP-Posting-Host: 166.102.15.34
X-Trace: iac5.navix.net 1009786506 23285 166.102.15.34 (31 Dec 2001 08:15:06 GMT)
X-Complaints-To: ab...@navix.net
NNTP-Posting-Date: 31 Dec 2001 08:15:06 GMT
X-No-Archive: yes
Comment: Anarchy! Fuck You!
X-Commentary: I love NewsAgent 1.10, Sandblaster Build 74 (19 March 1999) and the Polaris Cancel Engine V. 6.1
X-Unacanc3l: yes
This message was cancelled from within Mozilla...not
Frank
One of our managers was on holidays since 20/12 so his virus
protection wasn't updated so this little virus got in
http://www.sarc.com/avcenter/venc/data/w32....@mm.html during the
small window of opportunity between him starting his computer auto
starting his e-mail and his virus definitions being updated.
Ran a Virus scan and it found the virus in his windows/temp directory.
Good luck
frank
Hanan Cohen <hanan...@yahoo.com> wrote in message news:<3C2F2ED0...@yahoo.com>...
========= WAS CANCELLED BY =======:
Path: news.sol.net!spool1-nwblwi.newsops.execpc.com!newsfeeds.sol.net!news-out.visi.com!hermes.visi.com!uunet!ash.uu.net!sac.uu.net!lax.uu.net!news.navix.net!u-n-c-a-n-c-e-l-l-e-r
From: f12...@excite.com.au (Frank)
Newsgroups: opera.test,comp.lang.c,alt.comp.virus
Subject: cmsg cancel <431ee27a.01123...@posting.google.com>
Control: cancel <431ee27a.01123...@posting.google.com>
Date: Mon, 31 Dec 2001 04:34:10 GMT
Organization: Navix Internet Subscribers
Lines: 2
Message-ID: <cancel.431ee27a.0...@posting.google.com>
NNTP-Posting-Host: 166.102.15.34
X-Trace: iac5.navix.net 1009786412 23285 166.102.15.34 (31 Dec 2001 08:13:32 GMT)
X-Complaints-To: ab...@navix.net
NNTP-Posting-Date: 31 Dec 2001 08:13:32 GMT
Jeremy Leasure
are you using Novell or Win Server?
Jeremy
"Frank" <f12...@excite.com.au> wrote in message
news:5$--$$-$$_%%__---$@news.noc.cabal.int...