Re: recent sadmin worm

[Robert Kinsey - VIS Contractor <robert.kinsey () sorta kelly af mil>]

Hello Vitaly,

I have found that removing the file extension also removes the "anti-virus"
scanner/signature problem that you alluded to, that being the vendors who
purposely build a detection string in a "virus" scanner to detect and limit
exploit code (non-malware).

By removing the extension (.z i p, .e x e, what-have-you) will typically
bypass most "scanners".  Simply inform the recipient(s) what the proper ext
should be when they save it down to a disk.

Regards,
Robert
--
ROBERT KINSEY - Analyst
Virus Analysis Team
AFCERT