Re: [Declude.Virus] Bagle.F - password protected Zip files

[Matt]

I just caught a .zip of Bagle.G which McAfee says is almost identical to Bagle.F.  Could there be no cause for alarm? 02/29/2004 23:29:29 Qbc230b2500aa8d4f MIME file: Jammie.zip [base64; Length=23210 Checksum=2443682] 02/29/2004 23:29:29 Qbc230b2500aa8d4f Scanner 1: Virus= W32/[EMAIL PROTECTED] Attachment=Jammie.zip [1] O 02/29/2004 23:29:32 Qbc230b2500aa8d4f Scanner 2: Virus= I-Worm/Bagle.G Attachment=Jammie.zip [1] O 02/29/2004 23:29:32 Qbc230b2500aa8d4f File(s) are INFECTED [ W32/[EMAIL PROTECTED]: 6] 02/29/2004 23:29:32 Qbc230b2500aa8d4f Deleting file with virus 02/29/2004 23:29:32 Qbc230b2500aa8d4f Deleting E-mail with virus! 02/29/2004 23:29:32 Qbc230b2500aa8d4f Scanned: CONTAINS A VIRUS [MIME: 2 23524] 02/29/2004 23:29:32 Qbc230b2500aa8d4f From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [outgoing from 151.198.155.141] 02/29/2004 23:29:32 Qbc230b2500aa8d4f Subject: Rena Matt Mike Nice wrote: Well, you knew it had to happen: A password protected archive with the virus including the password in the body of the {RANDOM} message. E-mail virus scanners can't scan inside password-protected files. Now the user gets it, and enters the password of course and promptly infects himself. As an ISP, it will be hard to block all ZIP files or even just password-protected ZIP files. We now need to be able to detect password-protected zip files, hold them, notify the recipient, and allow them to release the message. Sample below without virus Bagle.F --- ------------------------------------------- Sent: Sunday, February 29, 2004 7:04 PM Subject: Bad girl I am from Taiwan but I study in Camden, New Jersey now. I like to know people from different places . password for archive: 87326 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================