New virus

[Spicer, Kevin]

See below...

http://isc.sans.org/diary.php?storyid=1035

Has anyone seen these?  Looks like an interesting attack vector, I don't
think these files would be blocked by any of the default rules - so we
have to rely on AV only.

For now we're blocking those domains on our web proxies and blocking
message.zip in MailScanner

-- 
Kevin Spicer
Unix Systems Specialist
Millward Brown UK Limited

=================================================================

BMRB wins two BMRA awards - http://www.bmrb.co.uk
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB Limited accepts no liability 
in relation to any personal emails, or content of any email which 
does not directly relate to our business.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!