Re: [Declude.Virus] New MyDoom Variants

[Rick Davidson]

I also have a large amount of samples that use port 1640 as well as port 1639   Filtering for the following should prove helpful   My name is Jane, I am from Miami, FL. Hi! I am looking for new friends. I am from Miami PayPal has successfully charged $175 Look at my homepage with my last webcam photos! FREE ADULT VIDEO! SIGN UP NOW! :1639/ :1640/     Rick Davidson National Systems Manager North American Title Group - ----- Original Message ----- From: Rick Davidson To: [EMAIL PROTECTED] Sent: Tuesday, November 09, 2004 9:54 AM Subject: Re: [Declude.Virus] New MyDoom Variants If you have junkmail pro you can body filter for the following, if not setup Imail rules to look for these phrases   BODY  0 CONTAINS My name is Jane, I am from Miami, FL. BODY  0 CONTAINS Hi! I am looking for new friends. I am from Miami BODY  0 CONTAINS PayPal has successfully charged $175     Rick Davidson National Systems Manager North American Title Group - ----- Original Message ----- From: Don Hickey To: [EMAIL PROTECTED] Sent: Tuesday, November 09, 2004 9:24 AM Subject: Re: [Declude.Virus] New MyDoom Variants FYI - Mcafee is detecting it as a generic Mydoom variant. So far F-prot is not...   Don ----- Original Message ----- From: Don Hickey To: [EMAIL PROTECTED] Sent: Tuesday, November 09, 2004 8:13 AM Subject: [Declude.Virus] New MyDoom Variants   Since these emails come with just a link, will our antivirus scanners be able to detect these messages as viruses?   I am running Mcafee and F-Prot.   http://www.sarc.com/avcenter/venc/data/[EMAIL PROTECTED]   http://www.sarc.com/avcenter/venc/data/[EMAIL PROTECTED]   They both exploit an IFRAME vulnerability in Internet Explorer that  has not been patched by Microsoft.   Thanks   Don Hickey