* This is the modus mailing list *
We had a variant out that was too specific.
Note that norman did put out an update too a few minutes ago.
If worst comes to worst, just create a custom sieve script like so:
Go to antispam -> custom filters
Create a new script, paste this in in the body of the script:
if allof (
size :over 22k,
size :under 23k,
body :contains "attachement" ".zip"
) { discard; stop; }
Compile, Enable.
--
Yves Lacombe
Vircom Technical Support
Hi Yves,
Can you (or anyone else) confirm if Norman really has this in their latest definitions? Per their site, it isn't listed (Mydoom.A or Novarg.A). See their latest list:
Update 0126: Total new items binary & macro : 58
NO NEW ENGINE; using 5.60.21
Binary malware (viruses/worms/trojans):
---------------------------------------
Fakecmos.A
W32/Aimober.A
W32/Alight.2_0A
W32/Alight.2_0B
W32/Aobos.A
W32/AolAnnoyer.A
W32/AolAnnoyer.B
W32/AolBlux.A
W32/AolBuddy.R
W32/AolBuster.A
W32/AolOwner.A
W32/Apsend.A
W32/Apsiv.A
W32/Bancodor.N
W32/Dalab.A
W32/Diskmaster.E
W32/Diskmaster.F
W32/Diskmaster.G
W32/Diskmaster.H
W32/Diskmaster.I
W32/[EMAIL PROTECTED]
W32/[EMAIL PROTECTED]
W32/Gabtroj.A
W32/Getoicq.A
W32/Gop.1_01
W32/Grobmail.A
W32/Hino.A
W32/Hino.B
W32/Hoaipw.A
W32/Hoaipw.B
W32/Jpgnet.A
W32/Meintro.A
W32/[EMAIL PROTECTED]
W32/Nsomail.A
W32/Parlay.A
W32/Pizdec.A
W32/Portram.A
W32/Psdmir.A
W32/Pswthif.A
W32/Rank.G
W32/Safari7.A
W32/Santuo.A
W32/SDBot.HV
W32/Sexsleep.A
W32/Sexsleep.B
W32/Smtptest.A
W32/Spashoot.A
W32/Suwener.A
W32/Timothy.A
W32/Treproxy.A
W32/Treproxy.B
W32/Vhsoft.A
W32/Vhsoft.B
W32/Willprox.A
Win/Aocrash.A
Win/AolTools.A
Win/Epod.A
Win/Sbuddy.A
----- Original Message -----
From: "Peter Lakanen" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, January 26, 2004 6:44 PM
Subject: [Modus] New E-Mail Virus Attack Style?
> * This is the modus mailing list *
>
> > DO AN UPDATE-NOW!!! :o)
> >
> > Norman catches it now ... so does Sieve.
>
> Well that's good to know, Yves, but I'm somewhat confused.
>
> I got my copy at 6:19 PM. At about 6:30, I clicked the Update button in
> Modus and it said I was up-to-date. I'm set to check for updates every
> 15 minutes.
>
> Anyone know when the update was first made available?
>
> I figure one of three things happened:
>
> - I got a variant not caught by the update.
>
> - I got updated between 6:19 and 6:30 automatically.
>
> - Something is broke.
>
> Thanks!
>
> -peter
>
> --
> Peter Lakanen [EMAIL PROTECTED]
> Platinum Web Development http://www.platinumweb.com
> 1320 Terrace Street Tallahassee, FL 32303
> 850.508.4518 FAX: 850.681.1930
>
>
> **
> To unsubscribe, send an Email to: [EMAIL PROTECTED]
> with the word "UNSUBSCRIBE" in the body or subject line.
>
**
To unsubscribe, send an Email to: [EMAIL PROTECTED]
with the word "UNSUBSCRIBE" in the body or subject line.
