[IMail Forum] New virus Bagle.J can't be caught by standard virus scanners

[R. Scott Perry]

FYI, there is a new virus that came out yesterday, Bagle.J.  It spreads in 
an encrypted .ZIP File.  While an AV program can detect a normal virus in 
an encrypted .ZIP file (by the name, file length, or CRC (the "fingerprint" 
of the file)), Bagle.J uses random file names, random file sizes, and 
random CRCs.  So it is unlikely that AV programs will be able to detect it.

As a result, we are recommending that users of Declude Virus ban all .ZIP 
files that contain encrypted files.  To do this, you need to be running the 
latest interim release, and add a line "BANEXT EZIP" to your virus.cfg file 
(it can go anywhere in the file).  To get the latest interim release, you 
must be covered by a Service Agreement; you can download it from 
http://www.declude.com/interim .

                                                   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/