As I know yes but 

BANNAME my_notebook.doc 

wouldn't work for files within zip-archives.

Markus 

> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
> Behalf Of John T (Lists)
> Sent: Tuesday, June 27, 2006 11:48 PM
> To: declude.virus@declude.com
> Subject: RE: [Declude.Virus] New Virus: zipped word doc with 
> Macro-Virus
> 
> Is the word document only named that?
> 
> John T
> eServices For You
> 
> "Seek, and ye shall find!"
> 
> > -----Original Message-----
> > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
> > Markus Gufler
> > Sent: Tuesday, June 27, 2006 11:32 AM
> > To: declude.virus@declude.com
> > Subject: [Declude.Virus] New Virus: zipped word doc with Macro-Virus
> > 
> > Some of us has noted in the past two hours that messages with an 
> > zip-file
> as
> > attachment has passed our virus filters
> > 
> > It's a zip-file containing a MS Word Document named 
> "my_notebook.doc"
> > 
> > Most Virus-Scanners can't catch it. Virustotal has returned 
> only two 
> > scanners with positive results
> > 
> > Sophos has found "WM97/Kukudro-A"
> > UNA has found a "Macro Virus"
> > 
> > No other AV-Engine has catched the suspicious file.
> > 
> > We've added the following lines to our virus.cfg in order 
> to block as 
> > much was we can at the moment.
> > 
> > BANNAME prices.zip
> > BANNAME apple_prices.zip
> > BANNAME sony_prices.zip
> > BANNAME hp_prices.zip
> > BANNAME dell_prices.zip
> > BANNAME My_Notebook.doc
> > 
> > Regards
> > Markus
> > 
> > 
> > 
> > ---
> > This E-mail came from the Declude.Virus mailing list.  To 
> unsubscribe, 
> > just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.Virus".    The archives can be found
> > at http://www.mail-archive.com.
> 
> 
> 
> 
> ---
> This E-mail came from the Declude.Virus mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.Virus".    The archives can be found
> at http://www.mail-archive.com.
> 
> 



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".    The archives can be found
at http://www.mail-archive.com.

Reply via email to