bagle-i worm
Stephen Conway
sconway at WLNET.COM
Tue Mar 2 19:43:07 GMT 2004
Good Day:
We are using 3.78 as attached, we are not using mailscanner for our
filtering engine at the present, although we are planning on installing
soon. Our current filter process we have a lot of custom rules, i.e. if
from user at a.com cc to user at b.com, or archive to /somedir/usera ..., Etc.
Can mailscanner do these types of things? Also, we need a log of all
messages sent through mailscanner with all details including size of
message, does mailscanners logs have this?
Also, we are interested to know how well does mailscanner perform under
heavy loads, as we tend to send / receive messages in large batches, causing
our existing filter processes to raise load averages and memory usage.
Thanks,
SC
-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf
Of Jason Balicki
Sent: Tuesday, March 02, 2004 1:50 PM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: bagle-i worm
>
>Does Sophos latest ide catch these, even if pw protected? Or should we
>upgrade sophos engine itself?
>
>Thanks,
>
If you want to send a copy to me I can let you know. I've
got the latest Sophos (3.79) with up to date IDE's.
I don't see any bagle-i in my logs, so that may or may
not be a bad sign. I'm at a relatively low volume
site.
--J(K)
-------------- next part --------------
SWEEP virus detection utility
Copyright (c) 1989,2004 Sophos Plc, www.sophos.com
System time 14:35:35, System date 02 March 2004
Product version : 3.78
Engine version : 2.18
User interface version : 2.07.046
Platform : Linux/Intel
Released : 02 February 2004
Total viruses (with IDEs) : 87555
Information on additional data files:
Data file name : /usr/local/sav/agobo-aw.ide
Data file type : IDE
Data file date : 01 December 2003, 06:56:13
Data file status : Loaded but out of date
Data file name : /usr/local/sav/agobotaa.ide
Data file type : IDE
Data file date : 22 October 2003, 11:33:58
Data file status : Loaded but out of date
Data file name : /usr/local/sav/agobotab.ide
Data file type : IDE
Data file date : 15 October 2003, 11:29:16
Data file status : Loaded but out of date
Data file name : /usr/local/sav/agobotac.ide
Data file type : IDE
Data file date : 24 October 2003, 05:54:09
Data file status : Loaded but out of date
Data file name : /usr/local/sav/agobotaf.ide
Data file type : IDE
Data file date : 27 October 2003, 11:18:08
Data file status : Loaded but out of date
Data file name : /usr/local/sav/agobotag.ide
Data file type : IDE
Data file date : 02 December 2003, 04:33:30
Data file status : Loaded but out of date
Data file name : /usr/local/sav/agobotas.ide
Data file type : IDE
Data file date : 27 November 2003, 07:29:57
Data file status : Loaded but out of date
Data file name : /usr/local/sav/agobotbd.ide
Data file type : IDE
Data file date : 08 December 2003, 11:32:52
Data file status : Loaded
Data file name : /usr/local/sav/agobotbm.ide
Data file type : IDE
Data file date : 15 December 2003, 10:22:50
Data file status : Loaded
Data file name : /usr/local/sav/agobotbt.ide
Data file type : IDE
Data file date : 30 December 2003, 06:31:52
Data file status : Loaded
Data file name : /usr/local/sav/antkldam.ide
Data file type : IDE
Data file date : 30 December 2003, 07:38:17
Data file status : Loaded
Data file name : /usr/local/sav/aozo-a.ide
Data file type : IDE
Data file date : 09 January 2004, 06:27:32
Data file status : Loaded
Data file name : /usr/local/sav/bagle-a.ide
Data file type : IDE
Data file date : 18 January 2004, 20:56:53
Data file status : Loaded
Data file name : /usr/local/sav/bdsinita.ide
Data file type : IDE
Data file date : 10 November 2003, 11:42:43
Data file status : Loaded but out of date
Data file name : /usr/local/sav/bodiru-a.ide
Data file type : IDE
Data file date : 22 December 2003, 10:18:21
Data file status : Loaded
Data file name : /usr/local/sav/corfloc.ide
Data file type : IDE
Data file date : 21 October 2003, 11:45:27
Data file status : Loaded but out of date
Data file name : /usr/local/sav/dafly-b.ide
Data file type : IDE
Data file date : 21 October 2003, 05:31:52
Data file status : Loaded but out of date
Data file name : /usr/local/sav/divix-a.ide
Data file type : IDE
Data file date : 16 January 2004, 12:26:49
Data file status : Loaded
Data file name : /usr/local/sav/dloaderf.ide
Data file type : IDE
Data file date : 11 December 2003, 06:50:36
Data file status : Loaded
Data file name : /usr/local/sav/dloaderk.ide
Data file type : IDE
Data file date : 06 January 2004, 05:37:59
Data file status : Loaded
Data file name : /usr/local/sav/dloaderl.ide
Data file type : IDE
Data file date : 09 January 2004, 09:25:25
Data file status : Loaded
Data file name : /usr/local/sav/donk-d.ide
Data file type : IDE
Data file date : 14 October 2003, 20:53:03
Data file status : Loaded but out of date
Data file name : /usr/local/sav/donk-e.ide
Data file type : IDE
Data file date : 17 October 2003, 05:01:20
Data file status : Loaded but out of date
Data file name : /usr/local/sav/dumaru-k.ide
Data file type : IDE
Data file date : 26 January 2004, 12:15:05
Data file status : Loaded
Data file name : /usr/local/sav/dumaru-y.ide
Data file type : IDE
Data file date : 24 January 2004, 14:24:22
Data file status : Loaded
Data file name : /usr/local/sav/eyeveg-b.ide
Data file type : IDE
Data file date : 29 January 2004, 08:11:20
Data file status : Loaded
Data file name : /usr/local/sav/flea-a.ide
Data file type : IDE
Data file date : 23 October 2003, 06:15:08
Data file status : Loaded but out of date
Data file name : /usr/local/sav/flea-b.ide
Data file type : IDE
Data file date : 20 November 2003, 11:21:57
Data file status : Loaded but out of date
Data file name : /usr/local/sav/flopcopy.ide
Data file type : IDE
Data file date : 23 January 2004, 08:06:39
Data file status : Loaded
Data file name : /usr/local/sav/gaggle-b.ide
Data file type : IDE
Data file date : 20 January 2004, 12:00:42
Data file status : Loaded
Data file name : /usr/local/sav/hacdef84.ide
Data file type : IDE
Data file date : 26 November 2003, 11:36:01
Data file status : Loaded but out of date
Data file name : /usr/local/sav/holar-i.ide
Data file type : IDE
Data file date : 29 October 2003, 07:04:19
Data file status : Loaded but out of date
Data file name : /usr/local/sav/inmotcda.ide
Data file type : IDE
Data file date : 10 October 2003, 02:51:51
Data file status : Loaded but out of date
Data file name : /usr/local/sav/inor-c.ide
Data file type : IDE
Data file date : 28 January 2004, 07:16:33
Data file status : Loaded
Data file name : /usr/local/sav/inorb.ide
Data file type : IDE
Data file date : 14 January 2004, 05:43:00
Data file status : Loaded
Data file name : /usr/local/sav/ircbot-p.ide
Data file type : IDE
Data file date : 20 October 2003, 21:15:13
Data file status : Loaded but out of date
Data file name : /usr/local/sav/litmusas.ide
Data file type : IDE
Data file date : 25 November 2003, 09:47:50
Data file status : Loaded but out of date
Data file name : /usr/local/sav/marq-a.ide
Data file type : IDE
Data file date : 27 October 2003, 10:03:38
Data file status : Loaded but out of date
Data file name : /usr/local/sav/mimail-l.ide
Data file type : IDE
Data file date : 01 December 2003, 23:27:46
Data file status : Loaded but out of date
Data file name : /usr/local/sav/mimail-m.ide
Data file type : IDE
Data file date : 31 December 2003, 06:48:05
Data file status : Loaded
Data file name : /usr/local/sav/mimail-n.ide
Data file type : IDE
Data file date : 08 January 2004, 07:37:17
Data file status : Loaded
Data file name : /usr/local/sav/mimail-q.ide
Data file type : IDE
Data file date : 26 January 2004, 13:52:26
Data file status : Loaded
Data file name : /usr/local/sav/mimail-s.ide
Data file type : IDE
Data file date : 28 January 2004, 22:08:36
Data file status : Loaded
Data file name : /usr/local/sav/mimailc.ide
Data file type : IDE
Data file date : 31 October 2003, 08:12:17
Data file status : Loaded but out of date
Data file name : /usr/local/sav/mimaile.ide
Data file type : IDE
Data file date : 01 November 2003, 19:56:49
Data file status : Loaded but out of date
Data file name : /usr/local/sav/mimailf.ide
Data file type : IDE
Data file date : 02 November 2003, 21:14:53
Data file status : Loaded but out of date
Data file name : /usr/local/sav/mimailh.ide
Data file type : IDE
Data file date : 03 November 2003, 10:47:49
Data file status : Loaded but out of date
Data file name : /usr/local/sav/mimaili.ide
Data file type : IDE
Data file date : 14 November 2003, 01:40:01
Data file status : Loaded but out of date
Data file name : /usr/local/sav/mimailj.ide
Data file type : IDE
Data file date : 17 November 2003, 18:57:12
Data file status : Loaded but out of date
Data file name : /usr/local/sav/mimailk.ide
Data file type : IDE
Data file date : 21 November 2003, 13:55:03
Data file status : Loaded but out of date
Data file name : /usr/local/sav/mmdloada.ide
Data file type : IDE
Data file date : 15 January 2004, 09:43:40
Data file status : Loaded
Data file name : /usr/local/sav/muly-a.ide
Data file type : IDE
Data file date : 12 November 2003, 10:13:25
Data file status : Loaded but out of date
Data file name : /usr/local/sav/mydoom-a.ide
Data file type : IDE
Data file date : 26 January 2004, 19:32:05
Data file status : Loaded
Data file name : /usr/local/sav/mydoom-b.ide
Data file type : IDE
Data file date : 30 January 2004, 10:41:30
Data file status : Loaded
Data file name : /usr/local/sav/opaser-s.ide
Data file type : IDE
Data file date : 24 December 2003, 06:18:47
Data file status : Loaded
Data file name : /usr/local/sav/opaservr.ide
Data file type : IDE
Data file date : 21 October 2003, 06:20:42
Data file status : Loaded but out of date
Data file name : /usr/local/sav/opaservv.ide
Data file type : IDE
Data file date : 17 November 2003, 00:45:44
Data file status : Loaded but out of date
Data file name : /usr/local/sav/proxin-a.ide
Data file type : IDE
Data file date : 20 January 2004, 05:36:23
Data file status : Loaded
Data file name : /usr/local/sav/randex-i.ide
Data file type : IDE
Data file date : 17 October 2003, 09:50:45
Data file status : Loaded but out of date
Data file name : /usr/local/sav/randex-q.ide
Data file type : IDE
Data file date : 23 October 2003, 10:59:33
Data file status : Loaded but out of date
Data file name : /usr/local/sav/randex-y.ide
Data file type : IDE
Data file date : 12 January 2004, 06:43:48
Data file status : Loaded
Data file name : /usr/local/sav/randonab.ide
Data file type : IDE
Data file date : 05 January 2004, 07:27:06
Data file status : Loaded
Data file name : /usr/local/sav/rirc-a.ide
Data file type : IDE
Data file date : 15 January 2004, 05:24:33
Data file status : Loaded
Data file name : /usr/local/sav/scold-a.ide
Data file type : IDE
Data file date : 11 December 2003, 06:19:01
Data file status : Loaded
Data file name : /usr/local/sav/sdbot-dc.ide
Data file type : IDE
Data file date : 26 January 2004, 09:37:25
Data file status : Loaded
Data file name : /usr/local/sav/sdbot-i.ide
Data file type : IDE
Data file date : 28 November 2003, 05:50:10
Data file status : Loaded but out of date
Data file name : /usr/local/sav/sdbot-l.ide
Data file type : IDE
Data file date : 04 December 2003, 11:35:03
Data file status : Loaded
Data file name : /usr/local/sav/sober-a.ide
Data file type : IDE
Data file date : 27 October 2003, 00:44:28
Data file status : Loaded but out of date
Data file name : /usr/local/sav/sober-b.ide
Data file type : IDE
Data file date : 18 December 2003, 10:55:43
Data file status : Loaded
Data file name : /usr/local/sav/sober-c.ide
Data file type : IDE
Data file date : 21 December 2003, 08:32:46
Data file status : Loaded
Data file name : /usr/local/sav/soberenc.ide
Data file type : IDE
Data file date : 30 October 2003, 06:33:17
Data file status : Loaded but out of date
Data file name : /usr/local/sav/spybot-r.ide
Data file type : IDE
Data file date : 14 October 2003, 10:06:39
Data file status : Loaded but out of date
Data file name : /usr/local/sav/spybot-v.ide
Data file type : IDE
Data file date : 07 November 2003, 06:13:31
Data file status : Loaded but out of date
Data file name : /usr/local/sav/spybot-w.ide
Data file type : IDE
Data file date : 06 November 2003, 05:02:54
Data file status : Loaded but out of date
Data file name : /usr/local/sav/start-bg.ide
Data file type : IDE
Data file date : 05 January 2004, 10:04:53
Data file status : Loaded
Data file name : /usr/local/sav/stawin-a.ide
Data file type : IDE
Data file date : 28 January 2004, 02:06:53
Data file status : Loaded
Data file name : /usr/local/sav/suzer-b.ide
Data file type : IDE
Data file date : 31 December 2003, 05:15:59
Data file status : Loaded
Data file name : /usr/local/sav/sysbug-a.ide
Data file type : IDE
Data file date : 25 November 2003, 03:01:14
Data file status : Loaded but out of date
Data file name : /usr/local/sav/tofger-a.ide
Data file type : IDE
Data file date : 19 November 2003, 11:46:00
Data file status : Loaded but out of date
Data file name : /usr/local/sav/tofger-l.ide
Data file type : IDE
Data file date : 23 December 2003, 05:57:07
Data file status : Loaded
Data file name : /usr/local/sav/uproot-a.ide
Data file type : IDE
Data file date : 02 January 2004, 05:54:44
Data file status : Loaded
Data file name : /usr/local/sav/weasyw-a.ide
Data file type : IDE
Data file date : 16 January 2004, 11:34:55
Data file status : Loaded
Data file name : /usr/local/sav/webberc.ide
Data file type : IDE
Data file date : 11 November 2003, 10:38:44
Data file status : Loaded but out of date
Data file name : /usr/local/sav/yaha-x.ide
Data file type : IDE
Data file date : 05 November 2003, 11:02:27
Data file status : Loaded but out of date
Data file name : /usr/local/sav/Yaha-y.ide
Data file type : IDE
Data file date : 10 December 2003, 10:24:10
Data file status : Loaded
Data file name : /usr/local/sav/zana-a.ide
Data file type : IDE
Data file date : 09 December 2003, 10:05:23
Data file status : Loaded
Data file name : /usr/local/sav/doomj-a.ide
Data file type : IDE
Data file date : 09 February 2004, 14:39:28
Data file status : Loaded
Data file name : /usr/local/sav/doomj-b.ide
Data file type : IDE
Data file date : 11 February 2004, 12:27:15
Data file status : Loaded
Data file name : /usr/local/sav/deadha-a.ide
Data file type : IDE
Data file date : 10 February 2004, 12:54:10
Data file status : Loaded
Data file name : /usr/local/sav/wukill-b.ide
Data file type : IDE
Data file date : 10 February 2004, 04:48:21
Data file status : Loaded
Data file name : /usr/local/sav/myss-c.ide
Data file type : IDE
Data file date : 09 February 2004, 11:33:43
Data file status : Loaded
Data file name : /usr/local/sav/sdbot-fm.ide
Data file type : IDE
Data file date : 06 February 2004, 10:25:52
Data file status : Loaded
Data file name : /usr/local/sav/agobotcp.ide
Data file type : IDE
Data file date : 06 February 2004, 08:36:19
Data file status : Loaded
Data file name : /usr/local/sav/mimail-t.ide
Data file type : IDE
Data file date : 05 February 2004, 12:08:27
Data file status : Loaded
Data file name : /usr/local/sav/holar-j.ide
Data file type : IDE
Data file date : 05 February 2004, 10:12:35
Data file status : Loaded
Data file name : /usr/local/sav/agobotcs.ide
Data file type : IDE
Data file date : 04 February 2004, 05:50:40
Data file status : Loaded
Data file name : /usr/local/sav/agobot-p.ide
Data file type : IDE
Data file date : 03 February 2004, 05:19:29
Data file status : Loaded
Data file name : /usr/local/sav/sdbot-w.ide
Data file type : IDE
Data file date : 02 February 2004, 10:48:30
Data file status : Loaded
Data file name : /usr/local/sav/nachi-b.ide
Data file type : IDE
Data file date : 11 February 2004, 22:53:39
Data file status : Loaded
Data file name : /usr/local/sav/mydoom-e.ide
Data file type : IDE
Data file date : 15 February 2004, 23:14:28
Data file status : Loaded
Data file name : /usr/local/sav/pinbol-a.ide
Data file type : IDE
Data file date : 13 February 2004, 07:21:43
Data file status : Loaded
Data file name : /usr/local/sav/doomhu-a.ide
Data file type : IDE
Data file date : 13 February 2004, 00:36:53
Data file status : Loaded
Data file name : /usr/local/sav/netsky-b.ide
Data file type : IDE
Data file date : 19 February 2004, 10:49:20
Data file status : Loaded
Data file name : /usr/local/sav/tanx-a.ide
Data file type : IDE
Data file date : 17 February 2004, 07:51:25
Data file status : Loaded
Data file name : /usr/local/sav/agobotcw.ide
Data file type : IDE
Data file date : 17 February 2004, 07:16:09
Data file status : Loaded
Data file name : /usr/local/sav/deadh-b.ide
Data file type : IDE
Data file date : 16 February 2004, 10:57:55
Data file status : Loaded
Data file name : /usr/local/sav/ddossm-b.ide
Data file type : IDE
Data file date : 19 February 2004, 07:02:25
Data file status : Loaded
Data file name : /usr/local/sav/mydoom-f.ide
Data file type : IDE
Data file date : 20 February 2004, 12:17:03
Data file status : Loaded
Data file name : /usr/local/sav/keyhosta.ide
Data file type : IDE
Data file date : 19 February 2004, 12:22:13
Data file status : Loaded
Data file name : /usr/local/sav/bizex-a.ide
Data file type : IDE
Data file date : 24 February 2004, 17:44:31
Data file status : Loaded
Data file name : /usr/local/sav/netsky-c.ide
Data file type : IDE
Data file date : 26 February 2004, 15:29:07
Data file status : Loaded
Data file name : /usr/local/sav/narhem-a.ide
Data file type : IDE
Data file date : 26 February 2004, 04:39:25
Data file status : Loaded
Data file name : /usr/local/sav/agobotfe.ide
Data file type : IDE
Data file date : 27 February 2004, 07:15:03
Data file status : Loaded
Data file name : /usr/local/sav/nachi-d.ide
Data file type : IDE
Data file date : 27 February 2004, 11:49:41
Data file status : Loaded
Data file name : /usr/local/sav/bagle-c.ide
Data file type : IDE
Data file date : 28 February 2004, 03:05:24
Data file status : Loaded
Data file name : /usr/local/sav/maddis-a.ide
Data file type : IDE
Data file date : 27 February 2004, 22:18:02
Data file status : Loaded
Data file name : /usr/local/sav/bagled.ide
Data file type : IDE
Data file date : 28 February 2004, 17:46:06
Data file status : Loaded
Data file name : /usr/local/sav/bagle-f.ide
Data file type : IDE
Data file date : 29 February 2004, 19:26:23
Data file status : Loaded
Data file name : /usr/local/sav/bagle-g.ide
Data file type : IDE
Data file date : 29 February 2004, 23:34:01
Data file status : Loaded
Data file name : /usr/local/sav/netsky-d.ide
Data file type : IDE
Data file date : 02 March 2004, 07:57:01
Data file status : Loaded
Data file name : /usr/local/sav/bagle-h.ide
Data file type : IDE
Data file date : 01 March 2004, 14:48:51
Data file status : Loaded
Data file name : /usr/local/sav/netsky-e.ide
Data file type : IDE
Data file date : 01 March 2004, 12:18:26
Data file status : Loaded
Data file name : /usr/local/sav/bagle-i.ide
Data file type : IDE
Data file date : 02 March 2004, 06:32:18
Data file status : Loaded
More information about the MailScanner
mailing list