RE: Bugbear.b not blocked! why?

I've heard more 'rumblings' about the current reincarnation of bugbear not being blocked 100% by AV - though a good practice would be to rigorously block/strip every attachement that contains '.exe', '.scr' or '.pif' somewhere in its filename. In combination with nohtml.dll (if you happen to run Outlook 2000/2002, see e.g.
http://ntbugtraq.ntadvice.com/default.asp?sid=1&pid=55&did=38) this would stop practically all Bears dead in their tracks, without harming functionality too much.

-----Original Message-----
From: Nick Warr [mailto:nick@mobilia.it] Sent: Tuesday, June 10, 2003 9:53 AM
To: gdecurtis@ennedi.com
Cc: focus-virus@securityfocus.com
Subject: Re: Bugbear.b not blocked! why?

I've seen viruses pass when they were corrupted (and non functional), we use a different mail scanner (rav) though.

Nick
----- Original Message -----
From: <gdecurtis@ennedi.com>
To: <focus-virus@securityfocus.com>
Sent: Monday, June 09, 2003 2:04 PM
Subject: Bugbear.b not blocked! why?

> Hi all,
-
> --------------------------------------------------------------------------

--

>




---------------------------------------------------------------------------
----------------------------------------------------------------------------

---------------------------------------------------------------------------
----------------------------------------------------------------------------