There appear to be several variants of Bagle. Declude/F-Prot is catching it in zip & pif files. Will add ezip to our banned extension list.
Thanks for the heads-up. Albert Booky Network Manager Kalispell Public Schools --------------- Declude Virus v1.76b caught the W32/[EMAIL PROTECTED] virus in Document.pif from [EMAIL PROTECTED] to: [EMAIL PROTECTED] Date: 03/03/2004 01:04:26 Declude Virus v1.76b caught the W32/[EMAIL PROTECTED] virus in beaacdacec.zip from [EMAIL PROTECTED] to: [EMAIL PROTECTED] Date: 03/03/2004 06:14:12 Declude Virus v1.76b caught the W32/[EMAIL PROTECTED] virus in Info.pif from [EMAIL PROTECTED] to: [EMAIL PROTECTED] Date: 03/03/2004 07:33:40 ----- Original Message ----- From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, March 03, 2004 7:08 AM Subject: [IMail Forum] New virus Bagle.J can't be caught by standard virus scanners > FYI, there is a new virus that came out yesterday, Bagle.J. It spreads in > an encrypted .ZIP File. While an AV program can detect a normal virus in > an encrypted .ZIP file (by the name, file length, or CRC (the "fingerprint" > of the file)), Bagle.J uses random file names, random file sizes, and > random CRCs. So it is unlikely that AV programs will be able to detect it. > > As a result, we are recommending that users of Declude Virus ban all .ZIP > files that contain encrypted files. To do this, you need to be running the > latest interim release, and add a line "BANEXT EZIP" to your virus.cfg file > (it can go anywhere in the file). To get the latest interim release, you > must be covered by a Service Agreement; you can download it from > http://www.declude.com/interim . > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers > since 2000. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > --- > [This E-mail scanned for viruses by Declude Virus] > > --- [This E-mail scanned for viruses by Declude Virus] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
