Subject: samsung

From: [email-masked], sookyoung <[email-masked]>
Date: Wed, 6 Nov 2002 10:37:49+0000

Hello,

Product Name: Microsoft Windows 2000
Product Id: 52455-270-5835392-09132

Process List:
MonSvcNT MonSvcNT
NtLmSsp NT LM Security Support Provider
ProtectedStorage Protected Storage
SamSs Security Accounts Manager
SysmonLog Performance Logs and Alerts
MonSvcNT MonSvcNT
NtLmSsp NT LM Security Support Provider
ProtectedStorage Protected Storage
SamSs Security Accounts Manager
SysmonLog Performance Logs and Alerts

Thank you.

---

From: "RAV AntiVirus" <[email-masked]>
Date: Wed, 06 Nov 2002 02:42:36 +0100

-----------------------
This e-mail is generated by the mailgw.local.ipunplugged.com mail server to warn you that the e-mail
sent by [email-masked] to [email-masked] is infected with virus: HTML/IFrame_Exploit*.

Please contact your system administrator for further information.

If you are the sender:
-------------------
The scanned e-mail has your address in the <From> header field. Either your
computer is infected or someone's computer having your e-mail address in
the address book has been infected.

(Please note that some viruses are sending e-mails directly from your computer.
Our advise is to check your computer using an up-to-date antivirus product).

If you are the receiver:
---------------------
Please contact the sender: very probably he/she doesn't know he/she has a computer virus.

Actions taken for the infected files:
-------------------------------------

The infected file was saved to quarantine with name: 1036546955-RAVgA61gWOX017645.
The file (part0000:)->(IFRAME0000) attached to mail (with subject:samsung) sent by [email-masked] to [email-masked]
is infected with virus: HTML/IFrame_Exploit*.
Cannot clean this file.
The file was successfully deleted by RAV AntiVirus.
The file (part0001:README.EXE) attached to mail (with subject:samsung) sent by [email-masked] to [email-masked]
is infected with virus: Win32/Brid.A@mm.
Cannot clean this file.
The file was successfully deleted by RAV AntiVirus.
------------------------
this is a copy of the e-mail header:

Copyright (c) since 1995 GeCAD The Software Company. All rights reserved.
Registered version for 2 domain(s).
Running on host: mailgw.local.ipunplugged.com

Scan engine 8.9 for i386.
Last update: Tue, 05 Nov 2002 09:31:10 +01
Scanning for 72972 malwares (viruses, trojans and worms).

You can download a free 30-day fully functional trial version of RAV AntiVirus v8
from: http://www.ravantivirus.com

---

From: "RAV AntiVirus" <[email-masked]>
Date: Wed, 06 Nov 2002 02:09:40 +0000

-----------------------
This e-mail is generated by the smtprelay.ua.pt mail server to warn you that the e-mail
having the subject: <samsung> is infected.
The infected mail was sent by [email-masked] to [email-masked], [email-masked].

Info for the sender:
-------------------
The scanned e-mail has your address in the From: header field. Either your
computer is infected or someone's computer having has your e-mail address
in the address book has been infected.

Info for the receiver:
---------------------
Please contact the sender: very probably he doesn't know he has a computer virus.

The infected file was saved to quarantine with name: 1036548579-5301297.msg.
The file (part0000:)->(IFRAME0000) attached to mail (with subject:samsung) sent by [email-masked] to [email-masked], [email-masked]
is infected with virus: HTML/IFrame_Exploit*.
The mail was not delivered because it contained dangerous code.

------------------------

RAV AntiVirus for Linux i386 version: 8.4.0 (snapshot-20020919)

Scan engine 8.9 for i386.
Last update: Mon, 04 Nov 2002 16:34:10 +00
Scanning for 72968 malwares (viruses, trojans and worms).