Wireshark-users: Re: [Wireshark-users] worm

From: Andrew Hood <ajhood@xxxxxxxxx>
Date: Fri, 04 May 2007 14:35:55 +1000

DENNIS CRAWLEY wrote:
> Hi,
> 
> This machine reaches the TCPIP XP limit of connections. I've made a wcap
> capture and it seems a worm is using the smtp.
> 
> Does anybody knows what worm is?. It's refused to be detected by most common
> antivirus.

ClamAv says:

worm.pcap: Email.Phishing.RB-732 FOUND

Took a fair bit of cpu and memory to scan it too.

-- 
There's no point in being grown up if you can't be childish sometimes.
                -- Dr. Who