Re: [vps-mail] New virus signature

[Scott Wiersdorf <scott@xxxxxxxxxxxx>]

On Mon, Aug 09, 2004 at 05:31:59PM -0700, Abigail Marshall wrote:
> There is a new virus which is a variant of Bagel - it comes
> with a zip file with some variant of price*.zip attached,
> and there is text in the body that is either the word
> "price" alone or "new price".  It is very small - only 9 kb,

That's pretty small. We've been accustomed to larger worms, certainly.
Thank you Abigail for the update.

Abigail, have you considered using sigtool (the clamav signature
generator)? I've read some of the documentation and it seems like it
might be worth investigating (and possibly less work to detect the
actual signature).

Has anyone here used sigtool before? It seems that it would help a lot
of people to kick back the signature to clamav itself so all those who 
are using clamav would receive the update automatically via normal
mechanisms.

Scott
-- 
Scott Wiersdorf
scott@xxxxxxxxxxxx
======================================================================
This is <vps-mail@xxxxxxxxxxxx>       <http://www.perlcode.org/lists/>
Before posting a question, please search the archives (see above URL).