New Trojan

[Scott Silva]

on 7-25-2008 12:17 AM Anthony Peacock spake the following:
> Hi,
> 
> dnsadmin 1bigthink.com wrote:
>> At 02:33 PM 7/24/2008, you wrote:
>>> Derek Buttineau wrote:
>>>> On 2008-Jul-24, at 1:53 PM, Hugo van der Kooij wrote:
>>>>
>>>>> -----BEGIN PGP SIGNED MESSAGE-----
>>>>> Hash: SHA1
>>>>>
>>>>> Scott Silva wrote:
>>>>>
>>>>> | I guess the blacklists have been helping me because I haven't 
>>>>> seen any.
>>>>> | But it is early, and now that I said something I will be 
>>>>> flooded.  ;-P
>>>>>
>>>>> If that helps to lay your hands on them I might want to claim I 
>>>>> have not
>>>>> yet received a single one of them.
>>>>>
>>>>> Hugo.
>>>> We're seeing a ton of them incoming now too, clamav is still not 
>>>> detecting them either :(
>>>> Derek
>>>
>>>
>>> What sig file are you running? Daily here is 7815
>>> We are catching them, and have been since sometime yesterday 
>>> afternoon (GMT-7).
>>>
>>> Clam calls them as Trojan.Zbot-1711, Trojan.Zbot-1712
>>>
>>> Ken
>>
>> I'm still not catching them with clamscan, I've got 7815 here, too, 
>> but running ClamAV 0.92.1 and suspect that is why.
>>
>> Thinking very seriously about upgrade today.
> 
> Clamav is still not catching the ones that claim to be from "Customs" 
> here, and I am running the latest version with the latest sigs.  Clam is 
> catching the 'Tax_invoice' variant though.
> 
> 
Have you submitted a sample to the Clam folks?


-- 
MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 258 bytes
Desc: OpenPGP digital signature
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20080725/57df1d22/signature.bin