> -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of > Brian Morrison > Subject: Re: [Clamav-users] Virus Name > > > Seems like any other sort of trojan to me, I can't see why > the signature > would be different because the zombie is using the ISP's smarthost for > outgoing mail. Of course ClamAV will be able to detect such a thing...
Wow.. I guess I was *really* unclear.. Lemme try again... The article suggests that this virus/trojan is already in the wild. Does anyone know which one the article is talking about? And does ClamAV already have a signature for it? > Well once such a Trojan appears and is reported to the ClamAV > team it's > signature will be added if it proves to be new, and ClamAV will detect > it if the payload is already recognised. Agreed.. I'm trying to find out if this has been reported already ... > It seems to me that this is almost a non-story, after all > some ISPs are > now blocking all mail from some other continents/countries, > so all mail > is blocked. That in some ways is far more concerning than a slight > change of tactics by the spam/trojan creators. Agreed. And I want to prevent having to do something of that sort. But as far as my email is concerned, I was trying to keep it on-topic. If this trojan were to be widespread, then RBL's could become virtually non-effective. Or, the RBL's could start putting legitimate hosts in the list. If that were to happen, that would be far more damaging... I'm trying to take a pro-active stance and beat them to the punchline. Many of the changes I've already put into effect, and others that are on the list to be done soon, were done to prevent scenarios such as this. I knew it was just a matter of time. That time is, apparently, now. > -- > > Brian Morrison My apologies for not being clear in the first place. -- Jason Frisvold Penteledata _______________________________________________ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
