Wow, we've had quite a few of these today!
It's the fastest spreading virus we have ever seen. We estimate that our customers have received over a million copies in the 3 hours since the first copy was sent out. Our customers that are running the latest beta version of Declude Virus that are using the new automatic detection of forging viruses have received copies of the virus from over 8,000 unique IPs so far.
So we just add this rule, right?
Body Contains filename="document.zip"
It's not that simple -- you really need AV software to get this one. We've seen dozens of different filenames. The major AV programs are catching it, so if you are running AV software, you should be protected.
If not, you may want to try temporarily blocking .exe/.pif/.scr/.cmd/.zip files.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
