[Mimedefang] Re: How to stop Neroma / 911 virus?

[Mike Heller]

I don't see any either, but I was hoping to be proactive in blocking

this virus.  Symantec didn't say anything about the file being an exe (I 
was also wondering how one would execute the jpg).  I already block exe 
files, so I guess I'm safe, but I'm wondering why my filter didn't work 
when I sent the test message.

So, suppose I wanted to block messages that had "911!" in the subject, 
how would I do that?

Mike

Joseph Brennan wrote:

> Here...
>
> http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100601
>
> ...they say the attachment name is Nerosys.exe with this remark
> in parentheses:   ("911.jpg" label is used)
>
> I was wondering how a jpg could be executed.  As usual they do not
> actually show us a sample message.
>
> I don't see any instance of Nerosys.exe (any case) in my system
> logs today.  We remove and log all exe files.