New Virus with Fake Microsoft Address...

[Ken Anderson]

I thought perhaps some were getting through undetected as well, until I
looked at the quarantine. The copies of the 'virus' that are getting
through (and blocked as dangerous filenames) have 0 byte .exe's attached.
The virus scanner isn't missing them, THEY are NOT infected.
In all other respects, they are identical to the virus infected emails.
Ken A.
Pacific.Net


Julian Field wrote:

> The newest code does have this:
>
> # *If* "Notify Senders" is set to yes, do you want to notify people
> # who sent you messages containing attachments that are blocked due to
> # their filename or file contents?
> # This can also be the filename of a ruleset.
> Notify Senders Of Blocked Filenames Or Filetypes = no
>
> Shame that your scanners don't reliably detect it.
>
> At 16:24 19/09/2003, you wrote:
>
>> I'd say 20% are being tagged as a virus here, while the rest are being
>> caught by file filter rules.  Kind of annoying because then the Silent
>> Virus feature doesn't kick in.
>>
>>
>> Steve Evans
>> SDSU Foundation
>>
>> -----Original Message-----
>> From: Ulysees [mailto:Ulysees at ULYSEES.COM]
>> Sent: Friday, September 19, 2003 3:54 AM
>> To: MAILSCANNER at JISCMAIL.AC.UK
>> Subject: Re: New Virus with Fake Microsoft Address...
>>
>> > Same MD5 sum I have here too, and ClamAV picks it up as Worm.Gibe.F
>>
>> Ok looks like I have a gremlin here somewhere, I've got other copies in
>> since, with the same md5sum and they get detected, but yet if I go and
>> scan the attachment from the earlier message in it still thinks it is
>> clean.
>> I think the scanners are just trying to annoy me
>>
>> Uly
>
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
>
>