Thanks, Uwe. I'm sure there will be more. Darin.
----- Original Message ----- From: "Info Wind" <[EMAIL PROTECTED]> To: <[email protected]> Sent: Tuesday, November 15, 2005 8:52 AM Subject: Re: [Declude.Virus] New Sober to be released, possible variation? We get one with foto.zip and word-text.zip Uwe P.S.: Thank you, Darin for the list. ----- Original Message ----- From: "Darin Cox" <[EMAIL PROTECTED]> To: <[email protected]> Sent: Tuesday, November 15, 2005 2:33 PM Subject: Re: [Declude.Virus] New Sober to be released, possible variation? >I just went through all of the reports. Here's a list of new filenames to > ban: > > # Added 11/15/2005 to handle new Sober.R, S, T, U, V, W variants > BANNAME email_photo.zip > BANNAME excel_table.zip > BANNAME liste.zip > BANNAME reg_text.zip > BANNAME registration.zip > BANNAME tabelle.zip > > > Darin. > > > ----- Original Message ----- > From: "Doug Anderson" <[EMAIL PROTECTED]> > To: <[email protected]> > Sent: Tuesday, November 15, 2005 8:24 AM > Subject: Re: [Declude.Virus] New Sober to be released, possible variation? > > > Looks like varying attachment names. I got one thats excel_table.zip > > ----- Original Message ----- > From: "David Dodell" <[EMAIL PROTECTED]> > To: "John T (Lists)" <[email protected]> > Sent: Tuesday, November 15, 2005 6:50 AM > Subject: Re: [Declude.Virus] New Sober to be released, possible variation? > > >> Monday, November 14, 2005, 10:50:00 PM, John T (Lists) wrote: >> >>> Sophos is now calling it Sober-R. >> >> Possible variation received this morning ... the text discussed >> receiving a problem email, and the attachment was email_photo.zip >> >> --- >> This E-mail came from the Declude.Virus mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.Virus". The archives can be found >> at http://www.mail-archive.com. >> >> [This E-mail scanned for viruses by Declude Virus] >> >> >> > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
