What's Going on here?

[Martin Sapsed]

Mike Kercher wrote:
> I've seen several emails come through that look like they got past Sophos,
> but the filename alone caught it.  For the most part, Sophos says the
> attachment is infected with Sobig.  Thoughts?

If I understand you correctly, you're seeing attachments which you would
expect to be Sobig-F. The filename rules pick them up but Sophos doesn't?

I've seen a few instances like this and having quarantined them, I sent
them to Sophos. They were all broken copies. I've also sometimes seen
Sobig-like attachments which were in fact empty. There were quite a lot
like this with Bugbear which caused them to issue the Bugbear-Dam ide.

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth