Spam Filter ISP Forums : win32.sober.N german/english worm https://www.logsat.com/spamfilter/forums/ Tue, 08 Sep 2026 08:43:24 +0000 Thu, 19 May 2005 10:15:37 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=5177 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[win32.sober.N german/english worm : For the win32.sober.N german/english...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5177&PID=5852&title=win32sobern-german-english-worm#5852 Author: Guests
Subject: 5177
Posted: 19 May 2005 at 10:15am

For the win32.sober.N german/english worm we all love - I have done the following:

1. put the known attachment names in the attachments filter:

account_info-text.zip
account_info.zip
<sender domain>_PassWort-Info.zip
autoemail-text.zip
mail_info.zip
error-mail_info.zip
okTicket-info.zip
Fifa_Info-Text.zip
our_secret.zip
LOL.zip

2. Also added worm german subject lines to the keyword filter:

Ihr Passwort
Mail-Fehler!
Ihre E-Mail wurdeverweigert
Ich bin' s, was zum lachen ;)
Glueckwunsch: Ihr WM Ticket
WM Ticket Verlosung
WM-Ticket-Auslosung

This reduced the flow of viruses passing through the filter.  I am not running the new norman virus plug-in.  I thought I would share the info and ask you to share any additional ideas regarding the filtering this threat. (keywords and subject lines are from Computer Associates)

Dwight

]]> Thu, 19 May 2005 10:15:37 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5177&PID=5852&title=win32sobern-german-english-worm#5852