[unisog] Sobig.f with stripped attachments.
m.sapsed at bangor.ac.uk
Thu Aug 28 16:43:28 GMT 2003
Michael Sofka wrote:
> I suspect there is a bug in Sobig.f that, depending on the infected
> machine, may not always attach the virus. Alternatively, the virus
> author intended this as another way of sowing uncertainty, doubt
> and annoyance. Or, perhaps to require we take steps such as blocking
> X-MailScanner, or certain, common, subjects.
Please don't block based on the X-MailScanner line - there are very many
sound systems using this excellent tool and you will block legitimate
mail from them. Genuine MailScanner users have been advised to localise
this header by a page at http://www.mailscanner.info but no doubt quite
a few won't get round to doing so or see the advice.
I seem to recall there's a Microsoft Outlook header in the Sobig
messages too - why not just block all mail with that header in?? ;-)
Information Services "Who do you say I am?"
University of Wales, Bangor Jesus of Nazareth
More information about the unisog