From: Joseph Brennan (no email)
Date: Thu Aug 02 2001 - 10:12:32 EDT
>> 3,521 match on body (first line of encoded virus)
>> TVpQAAIAAAAEAA8A//8AALgAAAAAAAAAQAAaAAAAAAAAAAAAAAAAAAAAAAAAAAA
>
> How uniqueu that is? (Or perhaps it is good idea to block all (or most) MS
> Windows excutables :-))
Since I wrote, I've seen an example with a slightly different first
line, so don't rely on this either.
Looking for filename extensions is better if you can pass a policy
against executables generally. It's a good idea.
Joseph Brennan
Academic Technologies Group, Academic Information Systems (AcIS)
|
|
|