Print Page | Close Window

win32.sober.N german/english worm

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5177
Printed Date: 05 February 2025 at 9:12am


Topic: win32.sober.N german/english worm
Posted By: Guests
Subject: win32.sober.N german/english worm
Date Posted: 19 May 2005 at 10:15am

For the win32.sober.N german/english worm we all love - I have done the following:

1. put the known attachment names in the attachments filter:

account_info-text.zip
account_info.zip
<sender domain>_PassWort-Info.zip
autoemail-text.zip
mail_info.zip
error-mail_info.zip
okTicket-info.zip
Fifa_Info-Text.zip
our_secret.zip
LOL.zip

2. Also added worm german subject lines to the keyword filter:

Ihr Passwort
Mail-Fehler!
Ihre E-Mail wurdeverweigert
Ich bin' s, was zum lachen ;)
Glueckwunsch: Ihr WM Ticket
WM Ticket Verlosung
WM-Ticket-Auslosung

This reduced the flow of viruses passing through the filter.  I am not running the new norman virus plug-in.  I thought I would share the info and ask you to share any additional ideas regarding the filtering this threat. (keywords and subject lines are from Computer Associates)

Dwight


Print Page | Close Window