Re: recent sadmin worm

From: Ryan Russell (ryanat_private)
Date: Tue May 15 2001 - 09:08:30 PDT

  • Next message: Tim Brown: "Re: Port 10008"

    Yup.  Most mail antivirus setups will react to all kinds of stuff,
    including keywords and file types.
    
    If you want to avoid finding out who is running what virus gateway, put
    the file in a password-protected .zip file.  You'll only get replies from
    a handful of gateways that block .zips.  Include the password in the note.
    
    The only downside here is that I believe this limits the people who can
    open the file to Windows users, maybe Mac.
    
    					Ryan
    
    On Tue, 15 May 2001, Vitaly Osipov wrote:
    
    > phew, I got about 200 replies from antivirus programs about "virus contained
    > in a message". I wonder what's the use of marking this _perl_ script as a
    > virus - it is an exploit program, no more, no less... Looks like it's a
    > rather non-creative attempt by virus-scanner makers to stop some popular
    > exploits (or to have a reason to say that their signature base is very big
    



    This archive was generated by hypermail 2b30 : Tue May 15 2001 - 09:52:26 PDT