Hi,
This morning I received a mail that had an attachment im_shocked.doc.zip and
detail in the subject field, the body contained this message
I was surprised, too!

Who_could_suspect_something_like_that? shityiiiii

First question is, is this a virus?

How did it get past my AV?

In the header it says that X-apparently sent to >>>my address, how does it
get sent to me?

Re: virus? by Alan

Alan
Sun Dec 19 01:51:29 CST 2004

Yes, it is a virus.
All my logs for "im_shocked*.zip are called Win32.Sober.I by eTrust 7.

Perhaps your AV is out of date?
Perhaps you don't have an AV that scans zip files?
Have you scanned inside the zip file?

It gets sent to you because it is sent to your address?
Am I missing something here?

...Alan

--
Alan Edwards, MS MVP W95/98 Systems
http://dts-l.org/index.html


In microsoft.public.security, "Tim" <noanswer@hotmail.com> wrote:

>Hi,
>This morning I received a mail that had an attachment im_shocked.doc.zip and
>detail in the subject field, the body contained this message
>I was surprised, too!
>
>Who_could_suspect_something_like_that? shityiiiii
>
>First question is, is this a virus?
>
>How did it get past my AV?
>
>In the header it says that X-apparently sent to >>>my address, how does it
>get sent to me?
>
>


Re: virus? by Tim

Tim
Sun Dec 19 02:36:56 CST 2004

Thanks Alan,
my Panda AV Titanium is up to date but Idont know if it scans zip files.

When I said how does it get sent to my addy, Of course I know that it does
because its here but the addy in the To: field wasn't mine it was
SMTP-mail@yahoo.co.uk what I want to know is how did the sender get my
address in the first place and is this a malicous attack against me or one
that multiplies as it is opened then sending to all contacts in address
book?
"Alan Edwards" <edwards@southcom.com.au> wrote in message
news:7ecas050e0vml9sgc4ra0tsr15ttr01die@4ax.com...
> Yes, it is a virus.
> All my logs for "im_shocked*.zip are called Win32.Sober.I by eTrust 7.
>
> Perhaps your AV is out of date?
> Perhaps you don't have an AV that scans zip files?
> Have you scanned inside the zip file?
>
> It gets sent to you because it is sent to your address?
> Am I missing something here?
>
> ...Alan
>
> --
> Alan Edwards, MS MVP W95/98 Systems
> http://dts-l.org/index.html
>
>
> In microsoft.public.security, "Tim" <noanswer@hotmail.com> wrote:
>
>>Hi,
>>This morning I received a mail that had an attachment im_shocked.doc.zip
>>and
>>detail in the subject field, the body contained this message
>>I was surprised, too!
>>
>>Who_could_suspect_something_like_that? shityiiiii
>>
>>First question is, is this a virus?
>>
>>How did it get past my AV?
>>
>>In the header it says that X-apparently sent to >>>my address, how does it
>>get sent to me?
>>
>>
>
>




Re: virus? by Alan

Alan
Sun Dec 19 02:58:15 CST 2004

I can't be certain how it got your address.
The To: field can be almost anything.
It is likely that someone who has you in their address book has a
virus but there can be many other ways of getting an address.

...Alan

--
Alan Edwards, MS MVP W95/98 Systems
http://dts-l.org/index.html

In microsoft.public.security, "Tim" <noanswer@hotmail.com> wrote:

>Thanks Alan,
>my Panda AV Titanium is up to date but Idont know if it scans zip files.
>
>When I said how does it get sent to my addy, Of course I know that it does
>because its here but the addy in the To: field wasn't mine it was
>SMTP-mail@yahoo.co.uk what I want to know is how did the sender get my
>address in the first place and is this a malicous attack against me or one
>that multiplies as it is opened then sending to all contacts in address
>book?
>"Alan Edwards" <edwards@southcom.com.au> wrote in message
>news:7ecas050e0vml9sgc4ra0tsr15ttr01die@4ax.com...
>> Yes, it is a virus.
>> All my logs for "im_shocked*.zip are called Win32.Sober.I by eTrust 7.
>>
>> Perhaps your AV is out of date?
>> Perhaps you don't have an AV that scans zip files?
>> Have you scanned inside the zip file?
>>
>> It gets sent to you because it is sent to your address?
>> Am I missing something here?
>>
>> ...Alan
>>
>> --
>> Alan Edwards, MS MVP W95/98 Systems
>> http://dts-l.org/index.html
>>
>>
>> In microsoft.public.security, "Tim" <noanswer@hotmail.com> wrote:
>>
>>>Hi,
>>>This morning I received a mail that had an attachment im_shocked.doc.zip
>>>and
>>>detail in the subject field, the body contained this message
>>>I was surprised, too!
>>>
>>>Who_could_suspect_something_like_that? shityiiiii
>>>
>>>First question is, is this a virus?
>>>
>>>How did it get past my AV?
>>>
>>>In the header it says that X-apparently sent to >>>my address, how does it
>>>get sent to me?
>>>
>>>
>>
>>
>
>


Re: virus? by Lanwench

Lanwench
Sun Dec 19 11:07:08 CST 2004

Tim wrote:
> Thanks Alan,
> my Panda AV Titanium is up to date but Idont know if it scans zip
> files.
>
> When I said how does it get sent to my addy, Of course I know that it
> does because its here but the addy in the To: field wasn't mine it was
> SMTP-mail@yahoo.co.uk

Your address was probably in the BCC field, then.

> what I want to know is how did the sender get my
> address in the first place

No way to know that.

> and is this a malicous attack against me
> or one that multiplies as it is opened then sending to all contacts
> in address book?

It's probably not a matter of you being singled out for abuse. Someone who
has you in their address book may have a virus.

> "Alan Edwards" <edwards@southcom.com.au> wrote in message
> news:7ecas050e0vml9sgc4ra0tsr15ttr01die@4ax.com...
>> Yes, it is a virus.
>> All my logs for "im_shocked*.zip are called Win32.Sober.I by eTrust
>> 7.
>>
>> Perhaps your AV is out of date?
>> Perhaps you don't have an AV that scans zip files?
>> Have you scanned inside the zip file?
>>
>> It gets sent to you because it is sent to your address?
>> Am I missing something here?
>>
>> ...Alan
>>
>> --
>> Alan Edwards, MS MVP W95/98 Systems
>> http://dts-l.org/index.html
>>
>>
>> In microsoft.public.security, "Tim" <noanswer@hotmail.com> wrote:
>>
>>> Hi,
>>> This morning I received a mail that had an attachment
>>> im_shocked.doc.zip and
>>> detail in the subject field, the body contained this message
>>> I was surprised, too!
>>>
>>> Who_could_suspect_something_like_that? shityiiiii
>>>
>>> First question is, is this a virus?
>>>
>>> How did it get past my AV?
>>>
>>> In the header it says that X-apparently sent to >>>my address, how
>>> does it get sent to me?