On Wed, 12 Jul 2000, Emil Tchomonev wrote:
> Does anybody have any suggestions about LIVE_STAGES.txt.SHS file???
There are detectors and cleaners out there, I think this one surfaced
about three weeks ago and escallated about two or three days out (maybe
around 6/20 cleaners were available. If it's actually LIVE_STAGES and not
LIFE_STAGES, it may be a variant, in which case you'll need to check with
your AV vendor- however I'm not sure we've seen any major variants out of
Stages yet. If you have good reason to think it's not the original Stages
worm, I'd appreciate a copy.
> I have found that this file was received many times by our mail server, and this is
>usual behavior of mail worms. Unfortunately I couldn't find anything written by AV
>companies.
Stages was fairly prevelant and spread a bit. If it hadn't been in the
wake of the love stuff it'd have been a much more signifcant event, but
the AV vendors got stuff out very quickly. Every major AV vendor that I
can think of had detection updates out almost immediately. Cleaners
followed about 48-72 hours later.
> Does anybody have some points???
If you get a virus, update your AV vendor's signatures/products to the
latest ones and see if it detects it. If it doesn't, contact your AV
vendor, they'll be able to help.
Some file-trapping products on NT had problems with .shs files because the
OS hides the extension from them, in that case you definitely need to talk
to the vendor. Some Exchange-based things don't do well under heavy load,
in that case you also need to talk to the vendor.
Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
[EMAIL PROTECTED] which may have no basis whatsoever in fact."
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
