[IAN] I-Worm/Klez.H

[Petr Stastny]

Ahoj,

    je to trosku off-topic, ale aby nam sem ty breberky uz nechodily, tak
posilam dva odkazy.
Ten prvni rika co to je a co s tim, a ten druhy Vam pomuze tomu alespon
trochu predchazet...

http://www.grisoft.cz/php/cs_faq.php3?typ=viry&co=klezh#odts_klez
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/
bulletin/MS02-015.asp

Happy

**************************************************
Petr ŠŤASTNÝ
Mobil: 0605 427 109
ICQ: 95612330
E-mail: Petr.Stastny.ov na seznam...
**************************************************
----- Original Message -----
From: "Mail Delivery Subsystem" <MAILER-DAEMON na ics....cz>
To: <dukla na centrum...>; <ian na amper....muni.cz>
Sent: Sunday, April 21, 2002 9:11 PM
Subject: [IAN] Returned mail: see transcript for details


> The original message was received at Sun, 21 Apr 2002 21:11:02 +0200
> from aragorn.ics.muni.cz [147.251.4.33]
>
>    ----- The following addresses had permanent fatal errors -----
> <ian na amper....muni.cz>
>
>    ----- Transcript of session follows -----
>
> !!! POZOR !!! POSTOVNI SERVER MU NALEZL VE VASI POSTE VIRUS.
> !!! POZOR !!! V PRILOZE MATE PODLE NASTAVENI VASI DOMENY BUD
> !!! POZOR !!! - HLAVICKU MAILU PRO PRIPADNY KONTAKT NA ODESILATELE
> !!! POZOR !!! - ZAVIROVANOU POSTU, VIRUS NEBYL SMAZAN.
> !!! POZOR !!!   PRED OTEVRENIM TAKOVE PRILOHY JE NUTNE MAIL ODVIROVAT.
>
>
> ANTIVIRUS SYSTEM FOUND VIRUSES
>
> From:    matous <matous na raz-dva...>
> To:      ian na amper....muni.cz
> Subject: Here to find out more!
>
> dfg3LJB2d6004654    archive: Mail
> dfg3LJB2d6004654/html    suspicion: Exploit.IFrame.FileDownload
> dfg3LJB2d6004654/sport    infected: I-Worm.Klez.h
> dfg3LJB2d6004654/sport    ok.
>
> This message contain viruses. Virus was detected
> with Antiviral Toolkit Pro from http://www.avp.ru.
> Complete mail is attached, you have to clean it
> with your favorite antivirus before reading.
>
> 554 5.6.0 Viruses were detected
> 501 5.6.0 Data format error
>


----------------------------------------------------------------------------
----


> Return-Path: <dukla na centrum...>
> Received: from aragorn.ics.muni.cz (aragorn.ics.muni.cz [147.251.4.33])
> by anor.ics.muni.cz (8.12.1/8.12.1) with ESMTP id g3LJB2d6004654
> for <ian na amper....muni.cz>; Sun, 21 Apr 2002 21:11:02 +0200
> Received: from mail.tiscali.cz (stateless3.tiscali.cz [213.235.135.72])
> by aragorn.ics.muni.cz (8.8.5/8.8.5) with ESMTP id VAA24558
> for <ian na amper....muni.cz>; Sun, 21 Apr 2002 21:10:29 +0200 (MEST)
> Received: from Glnkozrh (213.235.134.145) by mail.tiscali.cz (6.0.044)
>         id 3CA1A128001CAA8A for ian na amper....muni.cz; Sun, 21 Apr 2002
21:09:54 +0200
> Date: Sun, 21 Apr 2002 21:09:54 +0200 (added by
postmaster na mail....cz)
> Message-ID: <3CA1A128001CAA8A na stateless3....cz> (added by
postmaster na mail....cz)
> From: matous <matous na raz-dva...>
> To: ian na amper....muni.cz
> Subject: Here to find out more!
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary=XA50274gu1P05x9qrzbh8n857i3
> X-Muni-Spam-TestIP: 213.235.135.72
> X-Muni-Virus-Test: Found
>


---
Odchozí zpráva neobsahuje viry.
Zkontrolováno antivirovým systémem AVG (http://www.grisoft.cz).
Verze: 6.0.338 / Virová báze: 189 - datum vydání: 14.3.2002