Puff The Magic Wagon!

iTrader: (2)

Received this afternoon on my SIDC account (as above)

From - Helen Gregory

Subject - this is a comment transmit "hello"

"Keywords Keywords specify the structure of the script. Unlike commands, they do not perform an action. The keywords are listed below. proc name Indicates the beginning of a procedure. All scripts must have a main procedure (proc main). Script execution starts at the main procedure and terminates at the end of the main procedure. endproc Indicates the end of a procedure. When the script is executed to the endproc statement for the main procedure, Dial-Up Networking will start PPP or SLIP. "

Now obviously I haven't a clue (I believe) what this is about but concerningly, it comes with an attachment - <B>START.EXE</B>

No way am I going to open it (especially after spending a great deal of time recently disinfecting Nimda from 50 PCs ) but has anyone ever had this sent to them/shed any light/know Helen Gregory/or is it innocent?

As far as I can tell, Helen Gregory has never sent me anything ever before & "puff@sidc.co.uk" is quite a unique user-name

JackClark

Oops should have mentioned that! I'll put in a request to get the *preview* part of the text changed in the morning.

If you'd like a faster response you could try this

JackClark

Sounds viral to me, we have a number of them that will include text from a users document in the msg body and may randomise the attachment name. Forward it onto vsample@nai.com if you like.

Puff The Magic Wagon!

iTrader: (2)

Did that & got the Autoreply - which I'll paste here...

Didn't tell me anything about encapsulating in a zip file

I'm not sure if the attachment went through, but if it did, you might keep an eye out for it in case...

"" THIS IS AN AUTOREPLY.

Thank you for your message. We will review your email and
either send you a response or forward to the appropriate contact. If you
have sent us a file which contains a possible virus please ensure that it is
compressed in a password protected zip file with the password "infected"
(lower case) to one of the email addresses listed below.

Please note: We sometimes receive a file that is analysed as
cleaned, but actually find later that the file was infected when it left the
sender, and was cleaned somewhere along the line, hence the need for
password-protected zip files.

Our official response time for virus samples is 48 hours
(excluding weekends). This time may be extended when samples need to be
analysed by a senior researcher.


VSAMPLE REQUIRES THE FOLLOWING INFORMATION:

1. What symptoms cause you to suspect that your machine is infected
2. Whether any products find a virus (version number, company, results)

3. Your Virus Scan information (version number and DAT set number)
4. System details that may be relevant about your system
5. Your name, company name, phone number and email address if possible
6. A list of all items contained in the package/message you are
composing
7. An On-Demand scanner report that would show us your Scanner Engine.
DAT file and the file reported as infected if this is relevant. If you do
not know how to generate a report please contact technical support

We accept samples for analysis and possible inclusion into AV signature DAT
sets.
All product-related questions and comments can be addressed through
technical support and customer service, including:

* product installation and update questions
* product usage questions
* specific operating system/version questions

For samples related issues please contact:
UK : Vsample@nai.com
USA: Virus_Research@nai.com
Europe: Virus_Research_Europe@nai.com
Germany: Virus_Research_DE@nai.com
For Technical Support or Customer Services issues please contact:
Support:
* +44 (0) 1296 318 733
* +44 (0) 1296 318 734
Email: TVD-Support-UK@nai.com

Useful WEB sites

dba

ptmw

are you named after an aeroplane? You got a mention in the Gaurdian if you aren't,cus they named one after you otherwise!!