I have been getting hit all morning by messages containing W32.Novarg.A, which is so new that symantec doesn't even have a description of what it does yet.
All of the messages I've been getting have been coming from one ip (from North Carolina Roadrunner) and have spoofed from addresses. The weirdest thing is that they are being sent to nonexistent addresses on my pptb.net domain. I have the mail defaulting so that if the address doesn't exist that it goes in to a big default box. So, to stop the aggravation all I had to do was tell my server to quit accepting unless the address actually exists.
Don't know what the damn thing does, but they are sending it as various different attachments ie: body.zip, readme.zip, various different .scr and .exe files.
Anyway, I went ahead and sent an email to abuse at roadrunner for all the good that will do.
Just wanted to make sure everyone here was aware of it.
:angry:
|