These have been sufficient for us in the past to handle any new Bagle, MyTob, and JS/IllWill variants until updated defs caught them, though the list is over a year old now, so there may be some new filenames to add to the list.
BANNAME info-text.zip BANNAME 1.zip BANNAME 5.zip BANNAME 6.zip BANNAME 7.zip BANNAME 8.zip BANNAME be_not_jealous.zip BANNAME price_new_16_04_05.zip BANNAME work.zip BANNAME 08_price.zip BANNAME new__price.zip BANNAME new_price.zip BANNAME newprice.zip BANNAME price.zip BANNAME price_08.zip BANNAME price__new.zip BANNAME price_new.zip BANNAME price2.zip Darin. ----- Original Message ----- From: "Mario Antonio" <[EMAIL PROTECTED]> To: <[email protected]> Sent: Monday, September 19, 2005 10:28 AM Subject: Re: [Declude.Virus] New Variant of Bagle? Darin, Thanks, I am running the latest def of F-prot, and banning those filenames. I will ban zip extensions if the thing gets nasty. Mario Antonio ----- Original Message ----- From: "Darin Cox" <[EMAIL PROTECTED]> To: <[email protected]> Sent: Monday, September 19, 2005 10:11 AM Subject: Re: [Declude.Virus] New Variant of Bagle? > There may be a new variant of Bagle. There was a new one just last week. > > You should make sure your FProt defs are up to date. If it is a new > variant, you may want to block these files in your virus.cfg at least until > the defs have been updated to catch it. > > Darin. > > > ----- Original Message ----- > From: "Mario Antonio" <[EMAIL PROTECTED]> > To: <[email protected]> > Sent: Monday, September 19, 2005 10:01 AM > Subject: [Declude.Virus] New Variant of Bagle? > > > I see that Declude/F-PROT is not catching these virus: > > price.zip, new_price.zip, newprice.zip, price_09.zip, price2.zip, > new__price.zip > > I guess it could be a new variant of W32/[EMAIL PROTECTED] that was released > on > August last year. > > or Am I missing something? > > > Mario Antonio > > --- > [This e-mail was scanned for viruses by Webjogger's AntiVirus Protection > System] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- > [This e-mail was scanned for viruses by Webjogger's AntiVirus Protection System] > > --- [This e-mail was scanned for viruses by Webjogger's AntiVirus Protection System] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
