Sobig not detected

[Julian Field]

Can you tell me what version of Sophos you are using, and send me your
sobig-f IDE file? I'll see if it matches mine.

At 20:27 20/08/2003, you wrote:
>I can say without any problems that Sophos is missing 100% of the Sobig-F
>virus's.
>
>Rick Noble
>
>On Wed, 20 Aug 2003, Julian Field wrote:
>
> > At 18:54 20/08/2003, you wrote:
> > >On Wed, 20 Aug 2003, MailScanner Mailbox wrote:
> > >
> > > > Hello Group
> > > >
> > > > I have looked through the archives and see a lot of talk about Sobig-F,
> > > > except what seems to be happening to us.
> > > >
> > > > We are also getting the "Found to be clean" header along with the
> change
> > > > we made "Message infected" (shown below).
> > > >
> > > > It appears as though we are also not detecting the Sobig-F virus even
> > > > though we have the updated ide from Sophos. We are however catching
> most
> > > > of the Sobig-F infected emails due to the unsafe file attachments (scr,
> > > > pif, etc)
> > > >
> > > > Is anybody else not detecting Sobig-f ?
> > > > Currentley we are only running Sophos, and I can see that it is
> catching
> > > > other virus's.
> > > >
> > > > Thanks
> > > >
> > > > Rick Noble
> > >
> > >
> > >"The lyfe so short, the craft so long to learne"  Chaucer
> > >
> > > >We run 3 scanners, Sophos, Fprot and Kaspersky.
> > > >We concur that Sophos is not catching Sobig F 100% of the time
> > > >but fortunately if missed by Sophos it is always caught by both
> > > >Fprot and Kaspersky.
> > >
> > >Paul H
> >
> > If it's not 100%, any idea how many it is missing?
> > Mine might be missing about 40 out of 3000 but I'm going to have to do a
> > lot more careful analysis to work out exactly what files it is missing. If
> > it's worth the half-hour or so it'll take to do, then I'll do it. Otherwise
> > I've got lots more better things to do (content filtering).
> > --
> > Julian Field
> > www.MailScanner.info
> > Professional Support Services at www.MailScanner.biz
> > MailScanner thanks transtec Computers for their support
> >

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support