Re: Yet Another Virus was Re: [cobalt-users] Spam

[Shannon Johnston <sjohnston@xxxxxxxxxxxxxxx>]

Yep, that would be the Sobig.F variant.

Shannon Johnston



On Wed, 2003-08-20 at 08:33, Parker Morse wrote:
> On Wednesday, Aug 20, 2003, at 01:21 US/Eastern, René Mølsted wrote:
> > What we did, was blocking all mails with the stated subjects, so 
> > "nobody" accually got the virusthrough our servers.
> 
> I've been using the Procmail Sanitizer 
> <http://www.impsec.org/email-tools/procmail-security.html> on our Qube3 
> since Badtrans and Goner. It has been stopping the latest round quite 
> effectively without need of an update; it simply stops any message with 
> a "Windows Executable" attachment. (Among other things, it strips any 
> attachment with a .pif or .scr extension.)
> 
> That's pretty crude, but more accurate than simply subject-blocking; 
> someday, by accident, someone will use that subject on an innocent 
> email and not know why their message didn't get through.
> 
> The Sanitizer stopped 160 last night, when it usually finds fewer than 
> 10 with fewer than 30 users on the system.
> 
> pjm
> 
> _____________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To subscribe/unsubscribe, or to SEARCH THE ARCHIVES, go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users
-- 
Shannon Johnston <sjohnston@xxxxxxxxxxxxxxx>
Liberty Cavion