sober.g slipping through?
Raymond Dijkxhoorn
raymond at PROLOCATION.NET
Thu May 20 10:19:34 IST 2004
Hi Ken,
> Seeing some fake returned mail including sober.g getting through.
> sober.g is being caught in most cases though, so I don't think it's a
> virus scanner problem. We are running MailScanner-4.29.7-1
>
> Here's what the messages look like. Note this isn't the whole message,
> just the text at the top and the start of the attachment.
>
> Any ideas?
What scanner(s) are you using?
We for example noticed this:
144544 (first @ 00:00:51, last = 11:11:00) Worm.Sober.G
59276 (first @ 00:03:31, last = 11:12:58) W32/Sober.G at mm
Clam got 144.000 ones today, and f-prot 'only' 59k on the exact same box.
So the numbers should be around the same usually. Seems the one scanner is
picking up more variant then the other.
Bye,
Raymond.
-------------------------- MailScanner list ----------------------
To leave, send leave mailscanner to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/ and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html
More information about the MailScanner
mailing list