And in a similar vein: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ%5FB AGLE%2EDA&VSect=P
http://www.f-secure.com/v-descs/bagle_bi.shtml Andrew 8) > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner > Sent: Monday, September 19, 2005 8:51 AM > To: [email protected] > Subject: Re: [Declude.Virus] New Variant of Bagle? > > I just checked my F-Prot, and it has a date of 9/19/2005 for > both "Application/Script viruses and Trojans" and > "Document/Office/Macro viruses". This is newer than what is > on the F-Prot web site, which still says 16 Sep 2005 for > "Application/Script viruses and Trojans" and 6 Sep 2005 for > "Document/Office/Macro viruses". > > The latest virus threat they list on their site is a Zotob > variant dated 16 Sep 2005. > > The latest Bagle variant they list on their site is dated 1 Aug 2005. > http://www.f-prot.com/virusinfo/descriptions/bagle_ce.html > > You can always submit virus samples to them at > http://www.f-prot.com/virusinfo/submission_form.html > > > > -------- Original Message -------- > > From: "Mario Antonio" <[EMAIL PROTECTED]> > > Sent: Monday, September 19, 2005 10:30 AM > > To: [email protected] > > Subject: Re: [Declude.Virus] New Variant of Bagle? > > > > Darin, > > > > Thanks, I am running the latest def of F-prot, and banning > those filenames. > > I will ban zip extensions if the thing gets nasty. > > > > Mario Antonio > > > > ----- Original Message ----- > > From: "Darin Cox" <[EMAIL PROTECTED]> > > To: <[email protected]> > > Sent: Monday, September 19, 2005 10:11 AM > > Subject: Re: [Declude.Virus] New Variant of Bagle? > > > > > > > There may be a new variant of Bagle. There was a new one > just last week. > > > > > > You should make sure your FProt defs are up to date. If > it is a new > > > variant, you may want to block these files in your virus.cfg at > > > least > > until > > > the defs have been updated to catch it. > > > > > > Darin. > > > > > > > > > ----- Original Message ----- > > > From: "Mario Antonio" <[EMAIL PROTECTED]> > > > To: <[email protected]> > > > Sent: Monday, September 19, 2005 10:01 AM > > > Subject: [Declude.Virus] New Variant of Bagle? > > > > > > > > > I see that Declude/F-PROT is not catching these virus: > > > > > > price.zip, new_price.zip, newprice.zip, price_09.zip, price2.zip, > > > new__price.zip > > > > > > I guess it could be a new variant of W32/[EMAIL PROTECTED] that was > > > released on August last year. > > > > > > or Am I missing something? > > > > > > > > > Mario Antonio > > > > > > --- > > > [This e-mail was scanned for viruses by Webjogger's AntiVirus > > > Protection System] > > > > > > --- > > > This E-mail came from the Declude.Virus mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.Virus". The archives can be found > > > at http://www.mail-archive.com. > > > > > > --- > > > This E-mail came from the Declude.Virus mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.Virus". The archives can be found > > > at http://www.mail-archive.com. > > > --- > > > [This e-mail was scanned for viruses by Webjogger's AntiVirus > > > Protection > > System] > > > > > > > > > > --- > > [This e-mail was scanned for viruses by Webjogger's AntiVirus > > Protection System] > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, > > just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". The archives can be found > > at http://www.mail-archive.com. > > --- > > [This E-mail scanned for viruses by Declude Virus] > > > --- > [This E-mail scanned for viruses by Declude Virus] > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
