They probably added a signature for some of the bytes of the encrypted/zipped virus (as well as different signatures for the expanded version). The whole anti-virus scanning thing works on finding a unique pattern of data within the virus.
Tom -----Original Message----- From: Dumke, Jane [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 03, 2004 2:59 PM To: Exchange Discussions Subject: RE: BAGEL32.J Varient and ScanMail Engine. A lot of discussion has been going on here on our campus with the theme that password encrypted files can't be scanned. So why are Bagle.H variants being caught by ScanMail 6.2 for Exchange then? Are they using a heuristic to catch this instead of finding the actual virus pattern in the file itself? Jane Dumke Email Administrator University of Wisconsin - Stevens Point <mailto:[EMAIL PROTECTED]> phone:(715)346-2463 fax:(715)346-4577 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chinnery, Paul Sent: Wednesday, March 03, 2004 1:34 PM To: Exchange Discussions Subject: RE: BAGEL32.J Varient and ScanMail Engine. I just sent out an email to our users stating that for the forseeable future, all zip files will be blocked. That's gonna be a PITA. People have really come to rely zipping files. (Although why someone would zip a 500K Word doc down to 350K is beyond me.) Paul Chinnery Network Administrator Mem Med Ctr -----Original Message----- From: Pfefferkorn, Pete (pfeffepe) [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 03, 2004 1:26 PM To: Exchange Discussions Subject: RE: BAGEL32.J Varient and ScanMail Engine. I manually downloaded and updated both the engine as well as the new pattern that has not been released yet. I guess scanmail cannot scan password encrypted attachments so back to blocking the Zips. Sophos does not scan password encrypted either. -----Original Message----- From: Chinnery, Paul [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 03, 2004 1:06 PM To: Exchange Discussions Subject: RE: BAGEL32.J Varient and ScanMail Engine. Are you sure about the engine? Their sites says 6.810. We got a couple of the bagle.j come through. Thankfully, Trend's desktop AV caught them. Paul Chinnery Network Administrator Mem Med Ctr -----Original Message----- From: Pfefferkorn, Pete (pfeffepe) [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 03, 2004 9:46 AM To: Exchange Discussions Subject: BAGEL32.J Varient and ScanMail Engine. I noticed that Trend has a new engine out there 6.860 and the manual update does not update to that version. It looks as if the new BAGEL32.J variant got through on our system and I'm wondering if that engine is required to catch it? _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
