As I know yes but BANNAME my_notebook.doc
wouldn't work for files within zip-archives. Markus > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of John T (Lists) > Sent: Tuesday, June 27, 2006 11:48 PM > To: declude.virus@declude.com > Subject: RE: [Declude.Virus] New Virus: zipped word doc with > Macro-Virus > > Is the word document only named that? > > John T > eServices For You > > "Seek, and ye shall find!" > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > > Markus Gufler > > Sent: Tuesday, June 27, 2006 11:32 AM > > To: declude.virus@declude.com > > Subject: [Declude.Virus] New Virus: zipped word doc with Macro-Virus > > > > Some of us has noted in the past two hours that messages with an > > zip-file > as > > attachment has passed our virus filters > > > > It's a zip-file containing a MS Word Document named > "my_notebook.doc" > > > > Most Virus-Scanners can't catch it. Virustotal has returned > only two > > scanners with positive results > > > > Sophos has found "WM97/Kukudro-A" > > UNA has found a "Macro Virus" > > > > No other AV-Engine has catched the suspicious file. > > > > We've added the following lines to our virus.cfg in order > to block as > > much was we can at the moment. > > > > BANNAME prices.zip > > BANNAME apple_prices.zip > > BANNAME sony_prices.zip > > BANNAME hp_prices.zip > > BANNAME dell_prices.zip > > BANNAME My_Notebook.doc > > > > Regards > > Markus > > > > > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, > > just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". The archives can be found > > at http://www.mail-archive.com. > > > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.