[VIRUS] Nieuw virus op komst?

[WiNlUx]

Mensen, dit mailje kreeg ik vanmorgen in me postvak:

MS Partner

this is the latest version of security update, the "September 2003, Cumulative Patch" update which fixes all known security vulnerabilities affecting MS Internet Explorer, MS Outlook and MS Outlook Express. Install now to protect your computer from these vulnerabilities, the most serious of which could allow an malicious user to run executable on your computer. This update includes the functionality of all previously released patches.


System requirements Windows 95/98/Me/2000/NT/XP
This update applies to MS Internet Explorer, version 4.01 and later
MS Outlook, version 8.00 and later
MS Outlook Express, version 4.01 and later
Recommendation Customers should install the patch at the earliest opportunity.
How to install Run attached file. Choose Yes on displayed dialog box.
How to use You don't need to do anything after installing this item.

Microsoft Product Support Services and Knowledge Base articles can be found on the Microsoft Technical Support web site. For security-related information about Microsoft products, please visit the Microsoft Security Advisor web site, or Contact Us.

Thank you for using Microsoft products.

Please do not reply to this message. It was sent from an unmonitored e-mail address and we are unable to respond to any replies.

--------------------------------------------------------------------------------
The names of the actual companies and products mentioned herein are the trademarks of their respective owners.


Mijn Mdaemon server heeft netjes de attached Upgrade75.exe weggeknikkerd.

Kreeg ik nog een lief mailtje van de mailserver:

code:

The following message contained restricted attachment(s) which have been removed:

From      : [e-mail]
To        : [e-mail]
Subject   : Latest Pack
Message-ID: <20030919010454.ICFI29227.lakemtao04.cox.net@otvv>

Attachment(s) removed:
-----------------------------------------
Upgrade75.exe

En hier de headers van bovenstaande mailtje:

Received: from mail.onsdomein.nl ([212.203.14.97]) by onsdomein.nl ([192.168.1.3])
with DomainPOP (MDaemon.PRO.v6.7.9.R);
Fri, 19 Sep 2003 03:03:56 +0200
Return-Path: <[e-mail]>
Received: from lakemtao04.cox.net (lakemtao04.cox.net [68.1.17.241])
by goofy.eatserver.nl (8.11.6/8.11.6/SuSE Linux 0.5) with ESMTP id h8J15FG22469
for <mijn e-mailadres>; Fri, 19 Sep 2003 03:05:15 +0200
Received: from otvv ([68.105.14.30]) by lakemtao04.cox.net
(InterMail vM.5.01.06.05 201-253-122-130-105-20030824) with SMTP
id <20030919010454.ICFI29227.lakemtao04.cox.net@otvv>;
Thu, 18 Sep 2003 21:04:54 -0400
FROM: "MS Corporation Security Support" <[e-mail]>
TO: "Partner" <[e-mail]>
Subject: Latest Pack
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="avvepfnhzuejljwey"
Message-Id: <20030919010454.ICFI29227.lakemtao04.cox.net@otvv>
Date: Thu, 18 Sep 2003 21:05:16 -0400
X-UIDL: T,(#!p9&"!Qp]!!,A~!!
X-MDRemoteIP: 212.203.14.97
X-MDRcpt-To: [mijn e-mailadres]
X-MDaemon-Deliver-To: [mijn e-mailadres]

Op de server draai ik Symantec Antivirus Corporate Edition en daar is niets bekend of het een virus is.

Weet iemand hier dus of een virus verspreid word met bestandsnaam Upgrade75.exe???

[Emmeau]

yup, Microsoft verstuurt NOOIT binaries.

Was al eerder een post over

[WiNlUx]

Emmeau schreef op 19 September 2003 @ 07:26:
yup, Microsoft verstuurt NOOIT binaries.

Was al eerder een post over

Ok. Toch bedankt

[dawuss]

Het klinkt in ieder geval wel lekker obscuur dat mailtje

[Marzman]

Ik wordt gebombardeerd met dat mailtje Iedere keer als ik mijn mail ophaal heb ik er weer een paar. De aanhef en eerste alinea is bij mij wel iedere keer weer net iets anders.

Maar snel even mijn virusscanner geupdate: Viruses found in the attached files.
The attached file q524671.exe is infected by I-Worm/Swen.A. The attachment was moved to the virus vault.
The original message follows:

Het is dus een nieuwe I-Worm variant.

[ Voor 63% gewijzigd door Marzman op 19-09-2003 07:38 ]

[BaRF]

(nep) mail van Microsoft?

[momania]

Zie BarF ^^