[Dshield] New Virus??

Micheal Patterson micheal at tsgincorporated.com
Tue Jan 27 00:48:51 GMT 2004

----- Original Message ----- 
From: "Shannon Johnston" <sjohnston at cavionplus.com>
To: "'General DShield Discussion List'" <list at dshield.org>
Sent: Monday, January 26, 2004 4:57 PM
Subject: [Dshield] New Virus??

>I've been receiving emails throughout the day that have gotten by our
>virus scanners. Most of them have the subject of "Server Report". I
>can't find any references to such emails. They all contain an attachment
>with a variety of names such as: file.zip, text.pif, file.scr.
>Can anybody point me to a reference as to what this might be? I can
>provide the files if necessary.
>Shannon Johnston <sjohnston at cavionplus.com>
>Cavion Plus
> _______________________________________________
> list mailing list
> list at dshield.org
> To change your subscription options (or unsubscribe), see:

Starting at 3:14Pm CST, I started getting hit with something id'd by ClamAV
as Worm.SCO.A and by F-Prot as W32/Mydoom.A at mm. Since then I've gotten 32
and they're still coming. Google turned up nothing on SCO.A but Symantec has
a new def out today and id's it as W32.Novarg.A at mm. Symantec is listing this
as a category 4 worm and from the looks of things, it's definitely in the
wild. http://www.symantec.com/avcenter/venc/data/w32.novarg.a@mm.html
(may wrap).


Micheal Patterson
Network Administration
TSG Incorporated

More information about the list mailing list