New variant of MyDoom?

[Randal, Phil]

McAfee patterns updated automatically here at 01:02 GMT today to catch it.

They did have an extra.dat out to cover it yesterday afternoon (UK time).

And we're yet to see a copy of it.

Phil

---------------------------------------------
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Paul Arrington
> Sent: 23 February 2004 23:07
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: New variant of MyDoom?
>
>
> #-----Original Message-----
> #From: MailScanner mailing list
> #[mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Michael St. Laurent
> #Sent: Monday, February 23, 2004 5:54 PM
> #To: MAILSCANNER at JISCMAIL.AC.UK
> #Subject: Re: [MAILSCANNER] New variant of MyDoom?
> #
> #Bob Jones <mailto:bob.jones at USG.EDU> wrote:
> #> Hey all... we have recieved a few messages with .zip
> #attachments that
> #> aren't caught by the latest McAfee which seem to be a new
> variang of
> #> MyDoom.  All the virus company's websites are very slow
> right now so
> #> I'm assuming this is hitting a lot of people.  We have temporarily
> #> started blocking .zip attachments until we get definitions that can
> #> recognize it.  Just a heads up...
> #
> #Thanks for the heads-up.
> #
>
>
> Thanks from me, too.  Thought it might be this:
>
> http://vil.nai.com/vil/content/v_101038.htm
>
> (I use McAfee)  They are not officially releasing a
> definition for this
> until next week.  I installed their extra.dat file and
> immediately started
> seeing hits in the mail log.
>