[1148] in winnt
Re: .zi
daemon@ATHENA.MIT.EDU (Stephen Dowdy)
Wed Jul 2 15:13:33 2003
Message-Id: <5.1.0.14.2.20030702150707.028f2ef0@hesiod>
Date: Wed, 02 Jul 2003 15:13:30 -0400
To: "Stephen M. Downey" <sdowney@mit.edu>, Dave Broderick <djbroder@mit.edu>,
winpartners@mit.edu
From: Stephen Dowdy <sdowdy@MIT.EDU>
In-Reply-To: <5.1.0.14.2.20030702130630.029905c0@hesiod>
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary="=====================_101576178==_.ALT"
--=====================_101576178==_.ALT
Content-Type: text/plain; charset="us-ascii"; format=flowed
These are know to be from W32/Sobig.A, W32/Sobig.B, W32/Sobig.C,
W32/Sobig.D, and the lastest version W32/Sobig.E which was released last
week. Not only will you get .zi extensions from this one, you'll get .pi
and .sc (for .pif and .scr).
Not only does the DAT file need to be updated to version 4273, but your
scan engine must be at least at 4.1.60.
At 01:11 PM 7/2/2003 -0400, Stephen M. Downey wrote:
>No idea, unless your DATs aren't up to date.
>
>On a related note, I received what Jerry Isaacson said is likely the
>Colevo worm, another self-propagation worm with a low risk on it that
>picks an old email from an infected users machine and sends it along. The
>file I got was titled after what appeared to be the old email's subject
>line. The latest DATs, released yesterday, pick up on Colevo.11
>
>Steve
>
>At 01:03 PM 7/2/2003 -0400, Dave Broderick wrote:
>>I'm getting emails with what I believe to be viruses as attachments in ".zi"
>>
>>often "your details.zi"
>>
>>Why isn't Virus Scan picking these up?
>>
>>David J. Broderick
>>djbroder@mit.edu
>> Audio Visual Project Technician
>> MIT AV 617 253 2808
>> FAX 617 253 5945
>> <http://web.mit.edu/djbroder/www>http://web.mit.edu/djbroder/www
--=====================_101576178==_.ALT
Content-Type: text/html; charset="us-ascii"
<html>
These are know to be from W32/Sobig.A, W32/Sobig.B, W32/Sobig.C,
W32/Sobig.D, and the lastest version W32/Sobig.E which was released last
week. Not only will you get .zi extensions from this one, you'll
get .pi and .sc (for .pif and .scr).<br><br>
Not only does the DAT file need to be updated to version 4273, but your
scan engine must be at least at 4.1.60.<br><br>
<br>
At 01:11 PM 7/2/2003 -0400, Stephen M. Downey wrote:<br>
<blockquote type=cite class=cite cite>No idea, unless your DATs aren't up
to date.<br><br>
On a related note, I received what Jerry Isaacson said is likely the
Colevo worm, another self-propagation worm with a low risk on it that
picks an old email from an infected users machine and sends it
along. The file I got was titled after what appeared to be the old
email's subject line. The latest DATs, released yesterday, pick up
on Colevo.11<br><br>
Steve<br><br>
At 01:03 PM 7/2/2003 -0400, Dave Broderick wrote:<br>
<blockquote type=cite class=cite cite>I'm getting emails with what I
believe to be viruses as attachments in ".zi"<br><br>
often "your details.zi"<br><br>
Why isn't Virus Scan picking these up?<br><br>
David J. Broderick <br>
<font color="#0000FF"><b>djbroder@mit.edu <br>
</b></font><x-tab> </x-tab>Audio
Visual Project Technician<br>
<x-tab> </x-tab>MIT AV 617
<b>253 2808 <br>
</b><x-tab> </x-tab>FAX
617 253 5945 <br>
<x-tab> </x-tab><a href="http://web.mit.edu/djbroder/www">http://web.mit.edu/djbroder/www</a>
<br>
</blockquote></blockquote></html>
--=====================_101576178==_.ALT--
