Just found this on TrendMicro, so all those banning .exe and .pif should be fine:
>The email attachment, on the other hand, may be any of the following: > >Setup.exe >3 July 2002.doc.pif http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_BUG BEAR.A&VSect=T John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff Sent: Monday, September 30, 2002 10:30 AM To: [EMAIL PROTECTED] Subject: [Declude.Virus] FW: EMERGENCY ALERT: W32/Bugbear-A spreading rapidly FYI, this looks to be a bad one. I am still trying to see what the payload is, whether in the e-mail itself or in an attachment, and what kind of attachment. Any one know? John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -----Original Message----- From: Sophos Alert System [mailto:[EMAIL PROTECTED]] Sent: Monday, September 30, 2002 10:01 AM To: [EMAIL PROTECTED] Subject: EMERGENCY ALERT: W32/Bugbear-A spreading rapidly EMERGENCY ALERT: W32/Bugbear-A spreading rapidly Sophos has received several reports in a short space of time of users receiving an email-aware worm called W32/Bugbear-A. Sophos issued a virus identity (IDE) file for W32/Bugbear-A on 30th September 2002 and is recommending customers update their copies of Sophos Anti-Virus to protect against it. More information about W32/Bugbear-A can be found at http://www.sophos.com/virusinfo/analyses/w32bugbeara.html Download the IDE file from http://www.sophos.com/downloads/ide/bugbeara.ide Download a ZIP file containing all the IDE files available for the current version of Sophos Anti-Virus from http://www.sophos.com/downloads/ide/ides.zip Read about how to use IDE files at http://www.sophos.com/downloads/ide/using.html --------------------------------------------------------------------- To unsubscribe, email: [EMAIL PROTECTED] For additional commands, email: [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
