[Esa-l] Files to poison: Hybris

[Dustin Ankeny]

Well I think that was the point of Miguel's post today,

Not everyone wants to read alt.comp.virus all day so that the user can have
an up-to-the minute list.  So if they want to make a cron job that will take
advantage of a poisoned list that lots of informed people add to... well
that sounds like a good idea to me.  Now I know that it can get complex in a
hurry, but it does make sense.

What better way then to update your poisoned once a day/week?

Now the other side of that is that the list would have to be updated more
often, I update my list as soon as I see a new virus name that can be
filtered.  I don't think the master list gets updated near that often.

What do you guys think?
Dustin Ankeny


-----Original Message-----
From: esa-l-admin at spconnect.com [mailto:esa-l-admin at spconnect.com]On
Behalf Of Michael H. Martel
Sent: Wednesday, December 13, 2000 12:02 PM
To: esa-l at spconnect.com
Subject: Re: [Esa-l] Files to poison: Hybris



--On Wednesday, December 13, 2000 9:55 AM -0700 Brett Glass
<brett at lariat.org> wrote:

> If you're already poisoning *.scr, as the posted
> "poisoned" file does, all of the .scr file names
> in this list are redundant and will slow down your
> scripts. I just list the exe's.

I just gave up and now poison all .exe's .  Cuts down on the new viruses.

:-)



Michael

--

  -------------------------------o--------------------------------
  Michael H. Martel              | Vermont State Colleges
  martelm at quark.vsc.edu          | Technical Support Specialist
  http://probe.vsc.edu/~michael  | PH:802-241-2544 FX:802-241-3363


_______________________________________________
E-mail Security Announce list mailing list
E-mail Security Announce list at spconnect.com
http://www.spconnect.com/mailman/listinfo/esa-l