virus e-mails again

[Mike Kercher]

If you were running ClamAV or Sophos, you'd be detecting these as a Sober
variant.

Mike
 

> -----Original Message-----
> From: MailScanner mailing list 
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Venkata Achanta
> Sent: Tuesday, November 22, 2005 1:53 PM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: virus e-mails again
> 
> Since yesterday morning we are getting hit by lots of virus 
> e-mail with .exe attachments.
> 
> File-packed_da.exe, File-packed_dataInfo.exe
> 
> At Mon Nov 21 22:03:08 2005 the virus scanner said:
> Executable DOS/Windows programs are dangerous in email
> (File-packed_da.exe)
> Attachment is too small
> 
> The user community is in panic. i sent out a broadcast e-mail 
> letting the users know about the virus outbreak and blah blah. 
> 
> These are not getting scored high enough to be categorized as 
> spam. Users are getting tonnes of messages with just the 
> attachments stripped.
> 
> Right now i am collecting subject lines to put together a SA rule set.
> 
> Any other suggestions are welcome in the mean time. 
> 
> more info:
> 
> http://www.ironport.com/toc/toc_viruses.html
> 
> ------------------------ MailScanner list 
> ------------------------ To unsubscribe, email 
> jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) 
> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> Support MailScanner development - buy the book off the website!
> 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!