[unisog] Sobig.f with stripped attachments.

Martin Sapsed m.sapsed at bangor.ac.uk
Thu Aug 28 16:43:28 GMT 2003

Michael Sofka wrote:
> I suspect there is a bug in Sobig.f that, depending on the infected
> machine, may not always attach the virus.  Alternatively, the virus
> author intended this as another way of sowing uncertainty, doubt
> and annoyance.  Or, perhaps to require we take steps such as blocking
> X-MailScanner, or certain, common, subjects.

Please don't block based on the X-MailScanner line - there are very many 
sound systems using this excellent tool and you will block legitimate 
mail from them. Genuine MailScanner users have been advised to localise 
this header by a page at http://www.mailscanner.info but no doubt quite 
a few won't get round to doing so or see the advice.

I seem to recall there's a Microsoft Outlook header in the Sobig 
messages too - why not just block all mail with that header in?? ;-)



Martin Sapsed				
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

More information about the unisog mailing list