Wireshark · Wireshark-users: Re: [Wireshark-users] worm

[Andrew Hood <ajhood@xxxxxxxxx>]

DENNIS CRAWLEY wrote:
> Hi,
> 
> This machine reaches the TCPIP XP limit of connections. I've made a wcap
> capture and it seems a worm is using the smtp.
> 
> Does anybody knows what worm is?. It's refused to be detected by most common
> antivirus.

ClamAv says:

worm.pcap: Email.Phishing.RB-732 FOUND

Took a fair bit of cpu and memory to scan it too.

-- 
There's no point in being grown up if you can't be childish sometimes.
                -- Dr. Who