On the 2 servers I am actively working on this problem, I have seen over 1000 combined since it started. Amazing.
John Tolmachoff Engineer/Consultant/Owner eServices For You > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:IMail_Forum- > [EMAIL PROTECTED] On Behalf Of R. Scott Perry > Sent: Monday, January 26, 2004 3:55 PM > To: [EMAIL PROTECTED] > Subject: Re: [IMail Forum] New, fast-spreading virus-- > filename="document.zip" filename="document.zip" > > > >Wow, we've had quite a few of these today! > > It's the fastest spreading virus we have ever seen. We estimate that our > customers have received over a million copies in the 3 hours since the > first copy was sent out. Our customers that are running the latest beta > version of Declude Virus that are using the new automatic detection of > forging viruses have received copies of the virus from over 8,000 unique > IPs so far. > > >So we just add this rule, right? > > > >Body Contains filename="document.zip" > > It's not that simple -- you really need AV software to get this one. > We've > seen dozens of different filenames. The major AV programs are catching > it, > so if you are running AV software, you should be protected. > > If not, you may want to try temporarily blocking .exe/.pif/.scr/.cmd/.zip > files. > > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask about our free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
