25 Sep
2003
25 Sep
'03
10:34 a.m.
On Fri, 2003-09-26 at 16:51, Barry Murphy wrote:
Yeah I've blocked thousands, but 1 slipped through and seems to have a different sort of patern to it. I update definitions every day at midnight. Might have to change this to every hour :/
Gibe.F has a bug which causes a few of the attachments it sends out to be truncated. I've seen ones with completely empty attachments, ones with 1 KB attachments on up. These frequently slip past AV scanners because they don't contain whatever the signature is looking for. So far as I have been able to ascertain none of the truncated attachment are viable. -- Russell Fulton, Network Security Officer, The University of Auckland, New Zealand.