>
>On Thu, Jan 26, 2006 at 01:09:28PM +0100, Diego d'Ambra wrote:
>> Erik Corry wrote:
>> >On Thu, Jan 26, 2006 at 11:50:00AM +0100, Erik Corry wrote:
>> > >
>> > > How about:
>> > >
>> > >
>>
>>JS.Feebs-C.variant-ec:3:*:756e6573636170652822(253636|66)(253735|75)(25363e|6e
>)(253633|63)*(253237|2
Erik Corry wrote:
On Thu, Jan 26, 2006 at 01:09:28PM +0100, Diego d'Ambra wrote:
> Erik Corry wrote:
> >On Thu, Jan 26, 2006 at 11:50:00AM +0100, Erik Corry wrote:
> > >
> > > How about:
> > >
> > >
>
>JS.Feebs-C.variant-ec:3:*:756e6573636170652822(253636|66)(253735|75)(25363e|6e)(253633
On Thu, Jan 26, 2006 at 01:09:28PM +0100, Diego d'Ambra wrote:
> Erik Corry wrote:
> >On Thu, Jan 26, 2006 at 11:50:00AM +0100, Erik Corry wrote:
> > >
> > > How about:
> > >
> > >
> >JS.Feebs-C.variant-ec:3:*:756e6573636170652822(253636|66)(253735|75)(25363e|6e)(253633|63)*(253237|27)(253237|27)(
Erik Corry wrote:
On Thu, Jan 26, 2006 at 11:50:00AM +0100, Erik Corry wrote:
>
> How about:
>
>
JS.Feebs-C.variant-ec:3:*:756e6573636170652822(253636|66)(253735|75)(25363e|6e)(253633|63)*(253237|27)(253237|27)(25323c|2c)??(25323c|2c)??(25323c|2c)??(25323c|2c)
Sheesh, this sig making stuff
Erik Corry wrote:
On Thu, Jan 26, 2006 at 10:24:57AM +0100, Diego d'Ambra wrote:
> Erik Corry wrote:
> >On Wed, Jan 25, 2006 at 09:55:10PM +0100, Diego d'Ambra wrote:
> > > Erik Corry wrote:
> > > >
> > > >Suspicious.HTML.javascript2=756e6573636170652822253636
> > > >
> > > >Put it in a fi
On Thu, Jan 26, 2006 at 11:50:00AM +0100, Erik Corry wrote:
>
> How about:
>
> JS.Feebs-C.variant-ec:3:*:756e6573636170652822(253636|66)(253735|75)(25363e|6e)(253633|63)*(253237|27)(253237|27)(25323c|2c)??(25323c|2c)??(25323c|2c)??(25323c|2c)
Sheesh, this sig making stuff isn't as simple as it l
On Thu, Jan 26, 2006 at 10:24:57AM +0100, Diego d'Ambra wrote:
> Erik Corry wrote:
> >On Wed, Jan 25, 2006 at 09:55:10PM +0100, Diego d'Ambra wrote:
> > > Erik Corry wrote:
> > > >
> > > >Suspicious.HTML.javascript2=756e6573636170652822253636
> > > >
> > > >Put it in a file called local.db in the s
Erik Corry wrote:
On Wed, Jan 25, 2006 at 09:55:10PM +0100, Diego d'Ambra wrote:
> Erik Corry wrote:
> >
> >Suspicious.HTML.javascript2=756e6573636170652822253636
> >
> >Put it in a file called local.db in the same directory as your main.cvd
> >and daily.cvd files. It searches for the stri
On Wed, Jan 25, 2006 at 09:55:10PM +0100, Diego d'Ambra wrote:
> Erik Corry wrote:
> >
> >Suspicious.HTML.javascript2=756e6573636170652822253636
> >
> >Put it in a file called local.db in the same directory as your main.cvd
> >and daily.cvd files. It searches for the string:
> >
> >unescape ("%66
Diego d'Ambra wrote:
> Erik Corry wrote:
>> On Wed, Jan 25, 2006 at 01:19:58PM -0500, Mike Robinson wrote:
>> > Erik Corry wrote:
>> > >
>> > > The following signature seems to detec the Mytob variants on my
>> system:
>> > >
>> > > Suspicious.HTML.javascript2=756e6573636170652822253636
>> >
Erik Corry wrote:
On Tue, Jan 24, 2006 at 06:40:12PM -0500, Mike Robinson wrote:
> I've tried submitting a new Mytob variant over the last 2 days (still
> not being detected by ClamAV) and I've still not got a responseI
The following signature seems to detec the Mytob variants on my system
Erik Corry wrote:
On Wed, Jan 25, 2006 at 01:19:58PM -0500, Mike Robinson wrote:
> Erik Corry wrote:
> >
> > The following signature seems to detec the Mytob variants on my system:
> >
> > Suspicious.HTML.javascript2=756e6573636170652822253636
> >
> > Put it in a file called local.db in th
On Wed, Jan 25, 2006 at 01:19:58PM -0500, Mike Robinson wrote:
> Erik Corry wrote:
> >
> > The following signature seems to detec the Mytob variants on my system:
> >
> > Suspicious.HTML.javascript2=756e6573636170652822253636
> >
> > Put it in a file called local.db in the same directory as your ma
Erik Corry wrote:
> On Tue, Jan 24, 2006 at 06:40:12PM -0500, Mike Robinson wrote:
>
>> I've tried submitting a new Mytob variant over the last 2 days (still
>> not being detected by ClamAV) and I've still not got a responseI
>>
>
> The following signature seems to detec the Mytob varia
On Tue, Jan 24, 2006 at 06:40:12PM -0500, Mike Robinson wrote:
> I've tried submitting a new Mytob variant over the last 2 days (still
> not being detected by ClamAV) and I've still not got a responseI
The following signature seems to detec the Mytob variants on my system:
Suspicious.HTML.jav
I've tried submitting a new Mytob variant over the last 2 days (still
not being detected by ClamAV) and I've still not got a responseI
submitted these online...I got the confirmation pages, but no messages
afterward...I can still submit the email, zip, or the included pif to
the online scanner
16 matches
Mail list logo