Security Incidents mailing list archives
RE: strange qmail actions
From: "Bojan Zdrnja" <Bojan.Zdrnja () FER hr>
Date: Fri, 13 Jul 2001 10:46:42 +0200
-----Original Message----- From: Gerrit Scherpenzeel [mailto:n.scherpenzeel () chello nl] Sent: 12. lipanj 2001 10:17 To: incidents () securityfocus com Subject: strange qmail actions ----VEHAROPAJO1A7KLYBGXUN8H Content-Type: application/octet-stream; name="MLJAJCML.EXE" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="MLJAJCML.EXE" ..] Or something like this. Sounds like a outlook virus to me, but why these strange mail adresses?
This is probably W32/Hybris-C worm, which sends itself with different filenames. For more information check: http://www.sophos.com/virusinfo/analyses/w32hybrisc.html I happen to receive at least few of these worms each day :/ Regards, Bojan Zdrnja ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
Current thread:
- strange qmail actions Gerrit Scherpenzeel (Jul 12)
- RE: strange qmail actions Bojan Zdrnja (Jul 13)