-=> Steven Horn said to Greg Mayman
 -=> about "FTP07" on 04-20-03  23:18.....

 SH> To a point.  But would you open a message from "Bob Smth"
saying "I
 SH> love you?" 

Exactly.

IMO that was a big weakness of that virus. Much better (for the
virus) that the Subject line should look legitimate. Better still
that it attached itself to genuine messages without giving
anythingh away. I gather some of the Trojans are like that.

 GM> I'm surprised they didn't vary the Subj: from one message to the
 GM> next. One sneaky trick would be to copy messages from the Sent
 GM> Messages folder and resend them in infected form.

 SH> Someone will come up with that.

I'me sure they will. In fact I think my ISP has blocked a couple
like that already. I noticed them because they were from a friend
of my brother, and on a subject that only the two of them would
have been corresponding about. Additionally, the messages were
cut short and a note added by the ISP that the attachment had a
suspicious filename and extension, and so had been removed.

 SH> Agreed but on this occasion, McAfee was not far behind.

No, but my point is that they always _are_ behind.

 SH> My recollection is that what F-PROT claims to do is to be able to
 SH> identify virus types or structures in previously unknown programs. 
 SH> Does it work?  Who knows but I don't recall it identifying the Love Bug
 SH> virus. 

I have no idea whether it could or not. But think about this:

F-PROT is used by a lot less people than McAfee and Norton. And
there are a lot more out there that apparently have NO protection
at all, if I am to believe what they have told me.

So if F-PROT did protect those few who were using it, it would
still leave a lot of others to be infected and to spread the
virus.

+++THOUGHT FOR TODAY+++++++++++++++++++++++++++++++++++++++++++
    A moment's insight is sometimes worth a life's
    experience.
                        Oliver Wendell Holmes
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From Greg Mayman, in beautiful Adelaide, South Australia
   "Queen City of The South"    34:55 S  138:36 E

... Smoke usually means you've just exceeded peak performance.
___ Blue Wave/386 v2.30

--- FLAME v2.0/b