New Virus with Fake Microsoft Address...

[Steve Evans]

Actually I upgraded Sophos to the September release and I haven't gotten
any since.  It appears the August version was having issues. 


Steve Evans
SDSU Foundation

-----Original Message-----
From: Julian Field [mailto:mailscanner at ECS.SOTON.AC.UK] 
Sent: Friday, September 19, 2003 9:16 AM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: New Virus with Fake Microsoft Address...

The newest code does have this:

# *If* "Notify Senders" is set to yes, do you want to notify people #
who sent you messages containing attachments that are blocked due to #
their filename or file contents?
# This can also be the filename of a ruleset.
Notify Senders Of Blocked Filenames Or Filetypes = no

Shame that your scanners don't reliably detect it.

At 16:24 19/09/2003, you wrote:
>I'd say 20% are being tagged as a virus here, while the rest are being 
>caught by file filter rules.  Kind of annoying because then the Silent 
>Virus feature doesn't kick in.
>
>
>Steve Evans
>SDSU Foundation
>
>-----Original Message-----
>From: Ulysees [mailto:Ulysees at ULYSEES.COM]
>Sent: Friday, September 19, 2003 3:54 AM
>To: MAILSCANNER at JISCMAIL.AC.UK
>Subject: Re: New Virus with Fake Microsoft Address...
>
> > Same MD5 sum I have here too, and ClamAV picks it up as Worm.Gibe.F
>
>Ok looks like I have a gremlin here somewhere, I've got other copies in

>since, with the same md5sum and they get detected, but yet if I go and 
>scan the attachment from the earlier message in it still thinks it is 
>clean.
>I think the scanners are just trying to annoy me
>
>Uly

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support