I've only seen one Bagle.F today, it was a SCR file. If what you are saying is correct, and AV scanners called by Declude can't detect them, we might be able to work around it by using a filter in JunkMail to look at the base64 code.
Would you mind sending the source code to me and/or the list. If you create a text file with just the base64 code in it and zip it up, it should be no harm to anyone and it will allow us to study it.
Here's what Mcafee says about it.
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=101062
Thanks,
Matt
Mike Nice wrote:
Well, you knew it had to happen: A password protected archive with the virus including the password in the body of the {RANDOM} message. E-mail virus scanners can't scan inside password-protected files. Now the user gets it, and enters the password of course and promptly infects himself.
As an ISP, it will be hard to block all ZIP files or even just password-protected ZIP files. We now need to be able to detect password-protected zip files, hold them, notify the recipient, and allow them to release the message.
Sample below without virus Bagle.F --- ------------------------------------------- Sent: Sunday, February 29, 2004 7:04 PM Subject: Bad girl
I am from Taiwan but I study in Camden, New Jersey now. I like to know people from different places . password for archive: 87326
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
-- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
