Subject: samsung

From: [email-masked], sookyoung <[email-masked]>
Date: Wed, 6 Nov 2002 11:20:43+0000

Hello,

Product Name: Microsoft Windows 2000
Product Id: 52455-270-5835392-09132

Process List:
MonSvcNT MonSvcNT
NtLmSsp NT LM Security Support Provider
ProtectedStorage Protected Storage
SamSs Security Accounts Manager
SysmonLog Performance Logs and Alerts
MonSvcNT MonSvcNT
NtLmSsp NT LM Security Support Provider
ProtectedStorage Protected Storage
SamSs Security Accounts Manager
SysmonLog Performance Logs and Alerts

Thank you.

---

From: "RAV AntiVirus" <[email-masked]>
Date: Wed, 06 Nov 2002 03:26:42 +0100

-----------------------
This e-mail is generated by the mailgw.local.ipunplugged.com mail server to warn you that the e-mail
sent by [email-masked] to [email-masked] is infected with virus: HTML/IFrame_Exploit*.

Please contact your system administrator for further information.

If you are the sender:
-------------------
The scanned e-mail has your address in the <From> header field. Either your
computer is infected or someone's computer having your e-mail address in
the address book has been infected.

(Please note that some viruses are sending e-mails directly from your computer.
Our advise is to check your computer using an up-to-date antivirus product).

If you are the receiver:
---------------------
Please contact the sender: very probably he/she doesn't know he/she has a computer virus.

Actions taken for the infected files:
-------------------------------------

The infected file was saved to quarantine with name: 1036549601-RAVgA62QcOX020531.
The file (part0000:)->(IFRAME0000) attached to mail (with subject:samsung) sent by [email-masked] to [email-masked]
is infected with virus: HTML/IFrame_Exploit*.
Cannot clean this file.
The file was successfully deleted by RAV AntiVirus.
The file (part0001:README.EXE) attached to mail (with subject:samsung) sent by [email-masked] to [email-masked]
is infected with virus: Win32/Brid.A@mm.
Cannot clean this file.
The file was successfully deleted by RAV AntiVirus.
------------------------
this is a copy of the e-mail header:

Copyright (c) since 1995 GeCAD The Software Company. All rights reserved.
Registered version for 2 domain(s).
Running on host: mailgw.local.ipunplugged.com

Scan engine 8.9 for i386.
Last update: Tue, 05 Nov 2002 09:31:10 +01
Scanning for 72972 malwares (viruses, trojans and worms).

You can download a free 30-day fully functional trial version of RAV AntiVirus v8
from: http://www.ravantivirus.com

---

From: "Procmail Security daemon" <[email-masked]>
Date: Tue, 5 Nov 2002 20:24:37 -0600 (CST)

*** SECURITY WARNING ***
Our email gateway has detected that your message to
rlanka msgid=<[email-masked]>
MAY contain hazardous embedded scripting or attachments,
or has been rejected by our site security policy for some other reason.
If you have a question, please reply to this notification message.

It is POSSIBLE that your message was infected by a virus.
You should make sure your virus signature list
is up-to-date and then rescan your computer.

If the macro scanner score is large yet your virus scanner reports
that the document is not infected, try saving it using a different
format (such as Rich Text - "RTF") that will remove all macros.

REPORT: Trapped poisoned executable "README.EXE"
REPORT: Not a document, or already poisoned by filename. Not scanned for macros.
STATUS: Message quarantined, not delivered to recipient.

--
Message sanitized on tiberius
See http://www.impsec.org/email-tools/procmail-security.html for details.

---

From: "RAV AntiVirus" <[email-masked]>
Date: Wed, 06 Nov 2002 03:24:57 +0100

-----------------------
This e-mail is generated by the mailgw.local.ipunplugged.com mail server to warn you that the e-mail
sent by [email-masked] to [email-masked] is infected with virus: HTML/IFrame_Exploit*.

If you are the sender:
-------------------

If you are the receiver:
---------------------

The infected file was saved to quarantine with name: 1036549496-RAVgA62OrOX020410.
The file (part0000:)->(IFRAME0000) attached to mail (with subject:samsung) sent by [email-masked] to [email-masked]
is infected with virus: HTML/IFrame_Exploit*.
Cannot clean this file.
The file was successfully deleted by RAV AntiVirus.
The file (part0001:README.EXE) attached to mail (with subject:samsung) sent by [email-masked] to [email-masked]
is infected with virus: Win32/Brid.A@mm.
Cannot clean this file.
The file was successfully deleted by RAV AntiVirus.
------------------------
this is a copy of the e-mail header:

---

From: "RAV AntiVirus" <[email-masked]>
Date: Wed, 06 Nov 2002 03:25:15 +0100

-----------------------
This e-mail is generated by the mailgw.local.ipunplugged.com mail server to warn you that the e-mail
sent by [email-masked] to [email-masked] is infected with virus: HTML/IFrame_Exploit*.

If you are the sender:
-------------------

If you are the receiver:
---------------------

The infected file was saved to quarantine with name: 1036549513-RAVgA62PAOX020450.
The file (part0000:)->(IFRAME0000) attached to mail (with subject:samsung) sent by [email-masked] to [email-masked]
is infected with virus: HTML/IFrame_Exploit*.
Cannot clean this file.
The file was successfully deleted by RAV AntiVirus.
The file (part0001:README.EXE) attached to mail (with subject:samsung) sent by [email-masked] to [email-masked]
is infected with virus: Win32/Brid.A@mm.
Cannot clean this file.
The file was successfully deleted by RAV AntiVirus.
------------------------
this is a copy of the e-mail header: