If you intend on blocking this by Imail Rules, you will have to start by listing about 20 file names and growing.
John Tolmachoff Engineer/Consultant/Owner eServices For You > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:IMail_Forum- > [EMAIL PROTECTED] On Behalf Of Mike Biddle > Sent: Monday, January 26, 2004 3:31 PM > To: [EMAIL PROTECTED] > Subject: Re: [IMail Forum] New, fast-spreading virus-- > filename="document.zip" > > Wow, we've had quite a few of these today! So we just add this rule, > right? > > Body Contains filename="document.zip" > > Mike Biddle > http://www.websiteworld.com > Phone: 865-379-7171 > Fax: 865-379-7173 > MSN Instant Message [EMAIL PROTECTED] (not email IM Only) > ----- Original Message ----- > From: "Nick Hayer" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Monday, January 26, 2004 5:04 PM > Subject: Re: [IMail Forum] New, fast-spreading virus > > > > The viirus is called: > > W32/[EMAIL PROTECTED] virus > > [I think..] > > > > F-prot is missing it by mcafee is getting it. > > > > Here are some of the filenames: > > filename="document.zip" > > filename="body.zip" > > filename="message.zip" > > filename="body.scr" > > filename="message.scr" > > filename="file.zip" > > filename="data.scr" > > filename="text.pif" > > filename="doc.scr" > > filename="text.scr" > > > > -Nick Hayer > > > > Date sent: Mon, 26 Jan 2004 16:34:29 -0500 > > To: [EMAIL PROTECTED] > > From: "R. Scott Perry" <[EMAIL PROTECTED]> > > Subject: [IMail Forum] New, fast-spreading virus > > Organization: Computerized Horizons > > Send reply to: [EMAIL PROTECTED] > > > > > FYI, there is a new fast-spreading virus out there, that is too new to > > > be caught by AV programs yet. > > > > > > So far we have seen filenames of "body", "data", "document", "file", > > > "glszfj", "message", "readme", "test", "text", "vgsu042a", and > > > "vncexdl", with extensions of .pif, .scr, .zip. > > > > > > It may be a wise idea to temporarily ban .pif and .scr files (and > > > possibly .zip as well), if you do not already. If you are using > > > Declude Virus, you can use "BANEXT PIF" and "BANEXT SCR" in the > > > virus.cfg file to do this. > > > > > > -Scott > > > --- > > > Declude JunkMail: The advanced anti-spam solution for IMail > > > mailservers. Declude Virus: Catches known viruses and is the leader in > > > mailserver vulnerability detection. Find out what you've been missing: > > > Ask about our free 30-day evaluation. > > > > > > --- > > > [This E-mail was scanned for viruses by Declude Virus > > > (http://www.declude.com)] > > > > > > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > > > List Archive: > > > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge > > > Base/FAQ: http://www.ipswitch.com/support/IMail/ > > > > > > > > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > > List Archive: http://www.mail- > archive.com/imail_forum%40list.ipswitch.com/ > > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
