Re: [Declude.Virus] W32.Netsky.B@mm Slipping through

[Jonathan]

I realize this generally does mean it's corrupt -- but you're missing the 
"scary" part.  If I scan the file that came in with the same install of 
F-Prot, (from the mail server), it catches it as Netsky.

Jonathan

At 06:23 AM 2/23/2004, you wrote:

We've gotten several, here are a couple:
02/18/2004 10:33:12 Q93c835e1004873e1 Scanned: Virus Free [MIME: 2 22065]
02/18/2004 15:56:37 Qdf95a7880150b2de Scanned: Virus Free [MIME: 2 22057]
Running F-Prot, Mcafee and now AVG.
The "Virus Free" message means that none of the virus scanners detected a 
virus.

Most likely, these are corrupt, non-viable variants.  With Netsky, we've 
seen a version in .ZIP files that were corrupt (yet about the same size as 
normal), so that it would not be possible to extract the virus out of the 
.ZIP file.

                                                   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".    The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".    The archives can be found
at http://www.mail-archive.com.