Hello list,
Just a quick warning to the ones still running 0.83. There seems to be a variation of Bagle which is being catched only by the devel versions of clamav 0.84rc1 for example.
Could you please submit a sample to me (in a password protected zip file)?
The signatures [Worm.Bagle.BB, Worm.Bagle.BB-rar] works with 0.83 and does match samples I've reviewed so far.
What may be missing is signature for the worm behind yesterdays emails. They don't contain a worm, but a Trojan that downloads a worm, but none of the sites the Trojan tries to pull it from was online (at least none of the onces I tried).
Thanks in advance...
Best regards, Diego d'Ambra
_______________________________________________ http://lurker.clamav.net/list/clamav-users.html
