sober.g slipping through?

[Raymond Dijkxhoorn]

Hi Ken,

> Seeing some fake returned mail including sober.g getting through.
> sober.g is being caught in most cases though, so I don't think it's a
> virus scanner problem. We are running MailScanner-4.29.7-1
>
> Here's what the messages look like. Note this isn't the whole message,
> just the text at the top and the start of the attachment.
>
> Any ideas?

What scanner(s) are you using?

We for example noticed this:

144544  (first @ 00:00:51, last = 11:11:00)     Worm.Sober.G
59276   (first @ 00:03:31, last = 11:12:58)     W32/Sober.G at mm

Clam got 144.000 ones today, and f-prot 'only' 59k on the exact same box.
So the numbers should be around the same usually. Seems the one scanner is
picking up more variant then the other.

Bye,
Raymond.

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html