I just updated my F-PROT dats and resent the attachment somebody sent to the list not long ago (that was detected by somebody else on the list) and it still got through me. So your F-PROT must be picking up the file types that are not encrypted?
Regards, Lyndon. -----Original Message----- From: Albert Booky [mailto:[EMAIL PROTECTED] Sent: 03 March 2004 15:14 To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] New virus Bagle.J can't be caught by standard virus scanners There appear to be several variants of Bagle. Declude/F-Prot is catching it in zip & pif files. Will add ezip to our banned extension list. Thanks for the heads-up. Albert Booky Network Manager Kalispell Public Schools --------------- Declude Virus v1.76b caught the W32/[EMAIL PROTECTED] virus in Document.pif from [EMAIL PROTECTED] to: [EMAIL PROTECTED] Date: 03/03/2004 01:04:26 Declude Virus v1.76b caught the W32/[EMAIL PROTECTED] virus in beaacdacec.zip from [EMAIL PROTECTED] to: [EMAIL PROTECTED] Date: 03/03/2004 06:14:12 Declude Virus v1.76b caught the W32/[EMAIL PROTECTED] virus in Info.pif from [EMAIL PROTECTED] to: [EMAIL PROTECTED] Date: 03/03/2004 07:33:40 ----- Original Message ----- From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, March 03, 2004 7:08 AM Subject: [IMail Forum] New virus Bagle.J can't be caught by standard virus scanners > FYI, there is a new virus that came out yesterday, Bagle.J. It > spreads in an encrypted .ZIP File. While an AV program can detect a > normal virus in an encrypted .ZIP file (by the name, file length, or > CRC (the "fingerprint" > of the file)), Bagle.J uses random file names, random file sizes, and > random CRCs. So it is unlikely that AV programs will be able to > detect it. > > As a result, we are recommending that users of Declude Virus ban all > .ZIP files that contain encrypted files. To do this, you need to be > running the > latest interim release, and add a line "BANEXT EZIP" to your virus.cfg file > (it can go anywhere in the file). To get the latest interim release, > you must be covered by a Service Agreement; you can download it from > http://www.declude.com/interim . > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail > mailservers since 2000. Declude Virus: Catches known viruses and is > the leader in mailserver vulnerability detection. > Find out what you've been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > --- > [This E-mail scanned for viruses by Declude Virus] > > --- [This E-mail scanned for viruses by Declude Virus] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ ************************************************ Email checked by UKsubnet anti-virus service To prevent email abuse & block spam contact [EMAIL PROTECTED] Tel: +44(0)8712360301 Web: www.uksubnet.net Fax: +44(0)8712360300 Powered by UKsubnet Internet Service Provider Business to Business Internet (ISP) ************************************************ ************************************************ Email checked by UKsubnet anti-virus service To prevent email abuse & block spam contact [EMAIL PROTECTED] Tel: +44(0)8712360301 Web: www.uksubnet.net Fax: +44(0)8712360300 Powered by UKsubnet Internet Service Provider Business to Business Internet (ISP) ************************************************ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
