[Mimedefang] New .zip virus?

[Alastair Carey]

Hi David,

Yes, it's the W32.Novarg.A at mm worm (that just rolls off the tongue, doesn't
it? :)

Symantec report here:

http://securityresponse.symantec.com/avcenter/venc/data/w32.novarg.a@mm.html

The zip is a 22 Kb archive that includes a single file, the worm itself. The
zip file is delivered using multiple names (test.zip, doc.zip, etc.), and
the subject of the mail also changes. Assuming for a moment that one isn't
scanning viruses as part of the defanging process, is there an easy way of
blocking just these files and allowing other zip files through?

Cheers
Alastair

-----Original Message-----
From: David F. Skoll [mailto:dfs at roaringpenguin.com]
Sent: Tuesday, January 27, 2004 1:58 PM
To: mimedefang at lists.roaringpenguin.com
Subject: [Mimedefang] New .zip virus?


Hi,

I'm seeing bounces from messages I supposedly sent containing a .zip file.
I think there's a new .zip virus out there.  Watch out; the default filter
will not catch these.

Regards,

David.

--
David F. Skoll <dfs at roaringpenguin.com>    Roaring Penguin Software Inc.
+1 (613) 231-6599 ext. 100                 http://www.roaringpenguin.com/
_______________________________________________
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
MIMEDefang at lists.roaringpenguin.com
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang