Re: [Clamav-users] password-protected Worm.Bagle.F

2004-03-02 Thread Fajar A. Nugraha
David Jansen wrote: About the password-encrypted zip file virusses, is there any information available on the web about this? Try this http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_BAGLE.G Regards, Fajar --- SF.Net is s

Re: [Clamav-users] password-protected Worm.Bagle.F

2004-03-02 Thread David Jansen
About the password-encrypted zip file virusses, is there any information available on the web about this? I like to instruct my users about this new infection method. David Jansen --- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Bu

Re: [Clamav-users] password-protected Worm.Bagle.F

2004-03-01 Thread Martin Hermanowski
On Mon, Mar 01, 2004 at 09:06:12PM +0100, Erik Corry wrote: > On Mon, Mar 01, 2004 at 05:31:35PM +0700, Fajar A. Nugraha wrote: > > Bill Taroli wrote: > > > > >Perhaps a silly question... if the .ZIP attachment is passworded, how > > >are the target users supposed to be opening them and getting i

Re: [Clamav-users] password-protected Worm.Bagle.F

2004-03-01 Thread Erik Corry
On Mon, Mar 01, 2004 at 05:31:35PM +0700, Fajar A. Nugraha wrote: > Bill Taroli wrote: > > >Perhaps a silly question... if the .ZIP attachment is passworded, how > >are the target users supposed to be opening them and getting infected? > >Has the password been included in the email in which the

Re: [Clamav-users] password-protected Worm.Bagle.F

2004-03-01 Thread Jesper Juhl
On Mon, 1 Mar 2004, Ola Thoresen wrote: > Mon, 01 Mar 2004 at 09:06 GMT "Fajar A. Nugraha" <[EMAIL PROTECTED]> wrote > > > > Since the password is the same, hopefully it won't take virus db team > > long to update the signature. > > However what IF: > > > > - there's a new virus > > - the vir

Re: [Clamav-users] password-protected Worm.Bagle.F

2004-03-01 Thread Fajar A. Nugraha
Bill Taroli wrote: Perhaps a silly question... if the .ZIP attachment is passworded, how are the target users supposed to be opening them and getting infected? Has the password been included in the email in which the .ZIP was attached? No, silly me. I forgot to mention that the password is inc

Re: [Clamav-users] password-protected Worm.Bagle.F

2004-03-01 Thread Ola Thoresen
Mon, 01 Mar 2004 at 09:06 GMT "Fajar A. Nugraha" <[EMAIL PROTECTED]> wrote > Since the password is the same, hopefully it won't take virus db team > long to update the signature. > However what IF: > > - there's a new virus > - the virus just passes known (detected) worm, in a zip file > -

Re: [Clamav-users] password-protected Worm.Bagle.F

2004-03-01 Thread Bill Taroli
Perhaps a silly question... if the .ZIP attachment is passworded, how are the target users supposed to be opening them and getting infected? Has the password been included in the email in which the .ZIP was attached? Fajar A. Nugraha wrote: Fajar A. Nugraha wrote: So far (I only have two diffe

Re: [Clamav-users] password-protected Worm.Bagle.F

2004-03-01 Thread Fajar A. Nugraha
Fajar A. Nugraha wrote: So far (I only have two different samples now) the password is the same : 31517. Update : I just got another sample with different password (submission number 1534). Should I start blocking .zip files too? Regards, Fajar A. Nugraha