[Esa-l] Re: Help for HAHAHA

Andre Kajita - Administrador da Rede admin at camarasjc.sp.gov.br
Mon Feb 12 10:44:15 PST 2001


Greets,

> How should I modify poisoned to best prevent Hybris spread.

Being in a country where 98% of users use Outlook (and co.) and also
in the country that created the "Snow White Porn" (as I call it) I
receive at least 3 a day, all of them .scr.

> I already disallow all exe extensions
> further advice?

Blocking .scr is also useful - it's name variations have .exe or .scr
extensions.  If you're bold enough, save the file and run strings on
it, the name variations are near the end of the file.  BTW, there are
name variations for spanish, english, french and portuguese languages.

Andre.
-- 
Andre Kajita - Administrador da Rede <admin at camarasjc.sp.gov.br>
Camara Municipal de Sao Jose dos Campos - SP
http://www.camarasjc.sp.gov.br



More information about the esd-l mailing list