I've run into these as well, same symptoms, double zip file, lots of spaces .scr files. F-Prot with latest defs don't catch it, but am picking up other copies of MyDoom.O.
Jim Matuska Jr. Computer Tech II CCNA Nez Perce Tribe Information Systems [EMAIL PROTECTED] ----- Original Message ----- From: "Terry Fritts" <[EMAIL PROTECTED]> To: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> Sent: Monday, July 26, 2004 1:02 PM Subject: Re[2]: [Declude.Virus] Blocking the files in MyDoom > > > Also, I have temporarily blocked all zip files, as I am seeing quite a few > > that are not being caught by banned extension or F-Prot or AVG. I am > > investigating these. > > The ones I am seeing appear to be virus laden but would require the > user to unzip them and to take additional action to activate. > > The unzipped file name is "domain.com ... many spaces ... .scr" > Once I get it unzipped then FPROT and CLAMAV recognize it as a > MyDoom variant. McAffee did not trigger on it so not sure about it. > > Terry > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
