New Trojan

[Scott Silva]

on 7-24-2008 9:14 AM Anthony Cartmell spake the following:
>> are the file names consistent?
> 
> Possibly, yes, but I suspect only slightly. The filename in two zip 
> files I've seen is
> 
> Tax_Invoice_________________________NHHDLS883298792929.exe
> 
> Oddly Mailscanner doesn't stop this with .exe filename blocking although 
> I have max archive depth set to 3 (so it _should_ extract and inspect 
> the zip file contents?).
> 
> The unzipped .exe does get blocked as expected.
> 
> If I save the nasty carefully to my WinXP machine it appears with a fake 
> Word document icon (fake 'cause I use OpenOffice, not Word!).
> 
> HTH,
> 
> Anthony
I guess the blacklists have been helping me because I haven't seen any. But it 
is early, and now that I said something I will be flooded.  ;-P



-- 
MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 258 bytes
Desc: OpenPGP digital signature
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20080724/96532d72/signature.bin