Originally Posted by andygrif

It could well be that Norton haven't identified it yet as a virus. It's worth sending them the email along with the attachment to do some testing on.

Originally Posted by zovat

True, but Symantec said it was clean - and they are pretty quick at identifying virii once they are released...

Does seem strange though- Microsoft have never (to my knowledge) sent out any updates by Email.

Hmmm - a bit of googling tells me that this looks rather like the swen worm : see symantec's page - bit wierd that symantec said it looked ok though....

Originally Posted by Graham

Ok, here's a wierd one...

I got another one of those "This is a Micro$oft Update" e-mails seemingly trying to trick me into running the .exe attachment and infect my system.

Ho hum, thinks I, and I'm about to delete it when I suddenly realise that the message *doesn't* have a Norton AV warning of deletion in place of the attachment.

So I think "hello, that's odd" and get NAV to scan the attachment. To which it replies "it's clean".

Now this is strange, because it sure as hell *looks* like it's suspicious.

So I save the file, quarantine it, and send it off to Symantec for checking and get the reply back saying "this has been checked and it's the same as the official version of the install9.exe program"

This strikes me as totally bizarre. Someone sends out something that *looks* like a virus type message, but it's got perfectly legitimate content (and no other attachments), so what on *Earth* is the point?

Is someone *trying* to do me a favour by helping me to install updates on my system? (Not that I'd trust it anyway!) Is it a virus that's just really well concealed? (It doesn't seem to be)

Anyone got any ideas on this?

Originally Posted by Graham

<snip>
Anyone got any ideas on this?

Originally Posted by andygrif

It could well be that Norton haven't identified it yet as a virus. It's worth sending them the email along with the attachment to do some testing on.

Originally Posted by Xaccers

Its not a virus, so NAV wouldn't flag it up

Originally Posted by monkeybreath

Have you tried running an online scan of the file with a different AV program, eg http://housecall.trenmicro.com/

Originally Posted by Graham

Thanks, but that address comes up "not found".

Originally Posted by Xaccers

It could be a dialer rather than a virus
You know, the sort of thing that installs itself and tries to get your modem to call a premium rate number.
Its not a virus, so NAV wouldn't flag it up, tho it's still not a nice bit of software to have.