Bagle usually comes in several waves of slight variations, so this is likely to be happening again.
Banning the zip names is prudent. Andrew 8) > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Panda > Consulting S.A. Luis Alberto Arango > Sent: Monday, September 19, 2005 12:44 PM > To: [email protected] > Subject: RE: [Declude.Virus] New Variant of Bagle? > > I have latest definition signatures and still f-prot doesn't > catch the virus. > > I banned the files while f-prot comes with a definition file > that catches it. > > I already submitted the file to f-prot for analisys. > > Zone Alarm antivirus doesn't detect any virus in the file either. > The zip contains a file named price_list the size is 35.146 > > Luis Arango > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Mario Antonio > > Sent: Lunes, 19 de Septiembre de 2005 09:01 a.m. > > To: [email protected] > > Subject: [Declude.Virus] New Variant of Bagle? > > > > I see that Declude/F-PROT is not catching these virus: > > > > price.zip, new_price.zip, newprice.zip, price_09.zip, price2.zip, > > new__price.zip > > > > I guess it could be a new variant of W32/[EMAIL PROTECTED] that > was released > > on August last year. > > > > or Am I missing something? > > > > > > Mario Antonio > > > > --- > > [This e-mail was scanned for viruses by Webjogger's AntiVirus > > Protection System] > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, > > just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". The archives can be found > > at http://www.mail-archive.com. > > ______ > > [Email scanned for viruses] > > [Email escaneado contra virus] > > > > ______ > [Email scanned for viruses] > [Email escaneado contra virus] > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
