RE: Bugbear.b not blocked! why?

        We are seeing similar, Trends Interscan is not detecting the corrupted bugbear virus files, ie PE_Bugbear.DAM but Scanmail that we have installed on our exchange servers is detecting the files as PE_Bugbear.DAM and taking the appropriate action on them. This is one for Trend to explain I guess. Confirmation that you need virus protection in depth.

        Paul Charlish

-----Original Message-----
From: Thomas Hendrich [mailto:thendrich@lappen.de] Sent: 11 June 2003 07:15
To: focus-virus@securityfocus.com
Subject: Fw: Bugbear.b not blocked! why?

I´ve seen that happen in my environment for the last two or three days. Our TrendMicro InterScan did not recognize contemned eMail Attachments as infected with bugbear but our Norton AntiVirus installed on our workstations did.

Although I always have the latest virus pattern file which includes the definitions to detect the bugbear worm an update of the scan engine of the TrendMicro was the only way to get it filtered in our mail traffic.

And to be a little bit paranoid, I set up a Anti-Spam Rule to delete out all *.exe, *scr, *.pif etc and deliver it only to the postmaster for further investigation.

Seems to me that the bugbear will spread across the internet for some weeks because it is not just an automatic pattern update for the av produkts needed to get rid of it but a handish check of the version of the scan engine ...

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Thomas

• Original Message ----- From: <gdecurtis@ennedi.com> To: <focus-virus@securityfocus.com> Sent: Monday, June 09, 2003 2:04 PM Subject: Bugbear.b not blocked! why?

> Hi all,