mydoom

[Rick Cooper]

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Joe Stuart
> Sent: Monday, October 18, 2004 2:33 PM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: mydoom
>
>
> I am starting to have a problem with a Mydoom variant Mydoom.O that
> comes in a zip file that is not password protected.  I hae had no
> problem stopping this virus in the past. F-prot detects it if I run a
> manual scan, but when it comes through as mail it gets by. The only
> difference I can see between the past ones that got stopped and this one
> is that the one getting by is an archive that is 2 deep.  I have set
> Mailscanner up to scan archives that are up tp 25 deep, but they still
> get through. If anyone can help I would really appreciate it.
>
> Thanks
>

The second archive doesn't happen to have the same name as the parent does
it? Such as

file.zip contains another file named file.zip that contains the virus?

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).