RE: [Declude.Virus] AUTOFORGE

[Colbeck, Andrew]

I suggested adding STRATION a week or more ago.

 

Likewise, the string

 

WAREZOV

 

should be added to the AUTOFORGE database (or your own virus.cfg e.g. FORGINGVIRUS WAREZOV).  There have been many interations of this virus, and according to F-Secure, the creators are still pumping out new versions.

 

Andrew.

 

---

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt
Sent: Friday, October 27, 2006 6:03 AM
To: 'Declude Virus List'
Subject: [Declude.Virus] AUTOFORGE

Hi,

 

is this still being actively maintained?

 

If so,

    W32/Stration.dldr

should be added as forging. Based on bounces that I'm seeing (from inbound-only mailboxes on our domain) it is forging the sender.

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:    +1 201 934-9206

 

---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.