EvilBevel

Don't have the English text, but Outlook Express (I know, I know) suddenly refused to send mail (well, my ISP does) because I supposedly have a virus called Trojan.IframeExec.


Kan het bericht niet verzenden omdat één van de geadresseerden door de server is geweigerd. Het geweigerde e-mailadres is xxxxxxxx@xxxxx.com (removed for privacy) Onderwerp 'Re: stickers', Account: 'Pandora', Server: 'smtp.pandora.be', Protocol: SMTP, Reactie van server: '550 <D577990F.kabel.telenet.be[213.119.153.15]>: Client host rejected: uw computer is besmet met een virus, zie http://helpdesk.telenet.be/veiligheid/faqvirus.htm voor meer informatie!! Virusinfo: Trojan.IframeExec', Poort: 25, Beveiligd(SSL): Nee, Serverfout: 550, Foutnummer: 0x800CCC79

Searches on MacAfee and Symantec on this virus show no hits, nor does my Kasperski Antivirus software. ZoneAlarm is installed as well, and Shields Up reports my PC as being 100 % stealth.

So what's happening ?

Theo

JackClark

The only Antivirus I can find that uses that name is Dr Web. If I could understand Russian I could confirm that they have a false alarm problem.

Give this a go FreeScan let me know what it says.

EvilBevel

Thanks Jack,

Freescan does find a virus :


C:\WINDOWS\...\MailWasher\socketlog2273.txt Exploit-MIME.gen.exe


Really confused now, this is quite an old virus (11/14/2001) so should really be detected by Kasperski (daily -paying- updates etc) ? I have IE6/OE6, downloaded Iframe/Mime patches yonks ago.

The files that are supposedly infected are all log files from Mailwasher.

Welp ?

mannyo

Rough online translation, from dutch > english

It doesnot can send reported because one of the addressees have been refused by the server. The refused e mailadres are xxxxxxxx@xxxxx.com (removed for privacy) subject re: stickers, Account: ' Pandora ', server: smtp.Pandora.be, protocol: SMTP, response of server: 550 < D577990F.cable.telenet.be[213.119.153.15 ] >: Client leaps about rejected: your computer it has been contaminated with a virus, to see http://helpdesk.telenet.be/veiligheid/faqvirus.htm for further information!! virus information: Trojan.IframeExec, poort: 25. Protected (SSL): No, Serverfout: 550. Foutnummer: 0x800CCC79

JackClark

Kasperski probably didn't find that file as it's a txt file. May just be a remnant anyhow. I trust Kasperski and our detection rates over any Antivirus available, if you scan with both and find nothing then I say you're not infected.

EvilBevel

Thanks guys. Email started working again this morning without me doing anything, so I'm pretty sure it was a boo-boo on the ISP side of things.

As if we don't have enough hoaxes floating around