Virus (not hoax)

Adrian Bell · 25 Jun 2002, 06:57 AM

I received today a message that a mail I had sent was undeliverable. I had NOT sent the message and the headers were forged (they had the name of my ISP's mailserver wrong). The message had a .eml attachment which I did not open. On viewing the message source I came across this:-

Content-Type: audio/x-wav;
name=PORTpeter.wav.scr
Content-Transfer-Encoding: base64
Content-ID: <sitw>

This has a double extension and is an executable not an audio/x-wav file. I strongly suspect that it is a virus.

I only mention this as a warning to all, as last week my father got a very similar message.

Jeremy Howard · 25 Jun 2002, 07:24 AM

Yes, this is a virus. FastMail.FM blocks inline X-WAV attachments anyway, so all users of FastMail.FM are protected (even if you haven't got "virus protection" turned on!).

25 Jun 2002, 06:57 AM	#1
Adrian Bell Cornerstone of the Community Join Date: Apr 2001 Location: Darlington, UK Posts: 938	Virus (not hoax) I received today a message that a mail I had sent was undeliverable. I had NOT sent the message and the headers were forged (they had the name of my ISP's mailserver wrong). The message had a .eml attachment which I did not open. On viewing the message source I came across this:- Content-Type: audio/x-wav; name=PORTpeter.wav.scr Content-Transfer-Encoding: base64 Content-ID: <sitw> This has a double extension and is an executable not an audio/x-wav file. I strongly suspect that it is a virus. I only mention this as a warning to all, as last week my father got a very similar message.

25 Jun 2002, 07:24 AM	#2
Jeremy Howard Ultimate Contributor Join Date: Sep 2001 Location: Australia Posts: 11,501	Yes, this is a virus. FastMail.FM blocks inline X-WAV attachments anyway, so all users of FastMail.FM are protected (even if you haven't got "virus protection" turned on!).