RE: Novarg - Stopping .Zip Files

jamesworld_at_intelligencia.com
Date: 01/28/04

  • Next message: Luke Gill: "Re: New variant of Virus ?" 
    Date: Wed, 28 Jan 2004 13:12:51 -0600
To: "Tom Milliner" <milliner@gdar.org>

    Absolutely.

    Cisco Security Agent

    http://www.cisco.com/en/US/products/sw/secursw/ps5057/index.html

    Let me know if you have more questions about it.

    -James

    At 10:53 01/28/2004, Tom Milliner wrote:
    >
    >Could someone tell me if there is an IPS solution
    >which could be quickly programmed to stop .zip
    >files? I wish we could have stopped .zip files long
    >enough for our anti-virus program to get its updates.
    >
    >Tom Milliner, CPA, MCSE
    >Director of Information Services
    >Greater Dallas Assc of Realtors
    >8201 N. Stemmons Frwy
    >Dallas, TX 75247
    >www.gdar.org
    >mail to: milliner@gdar.org
    >(214) 540-2741
    >
    >
    >-----Original Message-----
    >From: sloppy seconds [mailto:beleguese@yahoo.com]
    >Sent: Tuesday, January 27, 2004 10:32 PM
    >To: incidents@securityfocus.com
    >Subject: Novarg
    >
    >To all,
    >
    >Yes as many of you have noticed Novarg is spreading
    >fast. I work for a large international corporation and
    >we have seen extensive infiltration. However, this
    >worm has not proved to be as "damaging" as some may
    >claim. The scary part is that our investment in AV
    >solutions (Trend, Symantec, et al...) has not
    >protected us. We are now reconsidering our stance on
    >allowing .ZIP files in Email.
    >
    >We engineered our own cleaning utility hours before
    >our AV vendors even had signatures. Infecting lab
    >clients and using diff tools...etc
    >
    > >From a network perspective we are watching for the
    >supposed DOS against SCO.
    >
    >We have had the outbreak under control just a few
    >hours after it's inception.
    >
    >Anyone care to contribute their experience?
    >
    >Thanks,
    >Beleguese
    >
    >
    >__________________________________
    >Do you Yahoo!?
    >Yahoo! SiteBuilder - Free web site building tool. Try it!
    >http://webhosting.yahoo.com/ps/sb/
    >
    >------------------------------------------------------------------------
    >---
    >------------------------------------------------------------------------
    >----
    >
    >
    >
    >---------------------------------------------------------------------------
    >----------------------------------------------------------------------------

    ---------------------------------------------------------------------------
    ----------------------------------------------------------------------------

  • Next message: Luke Gill: "Re: New variant of Virus ?"

    Relevant Pages

    • RE: Novarg - Stopping .Zip Files
      ... Could someone tell me if there is an IPS solution ... Greater Dallas Assc of Realtors ... Yes as many of you have noticed Novarg is spreading ... Do you Yahoo!? ...
      (Incidents)
    • RE: Novarg
      ... That means we aren't dependant on a virus signature being released to block ... this worm. ... Yes as many of you have noticed Novarg is spreading ... Do you Yahoo!? ...
      (Incidents)