Virus checking and .pif

DrStrabismus · 21 Aug 2003, 11:34 PM

According to the BBC website sobig carries a .pif file.

Isn't this in the same class as xxx.jpg.exe and
"xxx .exe "

i.e. shoudn't .pif files be trapped by the basic vius checking.

vidvandre · 22 Aug 2003, 12:20 AM

I've spotted the Sobig-F disguised as a scr...

Jeremy Howard · 22 Aug 2003, 11:41 AM

We've been blocking both .scr and .pif for the last few days. We'll probably keep these blocks in the long-term, since they're in the same category as *.*.exe, as you say - dangerous extensions with few valid purposes.

bitequator · 22 Aug 2003, 02:00 PM

Just curious, so it seems many mail AVs (like FM's KAV and Runbox's and others) have trouble stopping Sobig (or maybe just the lastest variant), even now?

We've had a wee bit of trouble (again) this week, with the latest Sobig.F variant, on our Symantec AV-protected Exchange at work...

P.S. .pif and .scr have been used since the very first Sobig variant IIRC...

fastashell · 22 Aug 2003, 02:26 PM

[QUOTE

.......

We've had a wee bit of trouble (again) this week, with the latest Sobig.F variant, on our Symantec AV-protected Exchange at work...

.......

[/b][/quote]

I'd be interested to hear a little more about this. I'm using Symantec corporate edtion to protect the servers, workstations and Exchange. As far as I can tell it's doing it's job so far. I did some system wide scans on the network and found 4 infected files that had slipped through somehow but the scans caught and killed them. What sort of trouble are you having? Do you have the latest version and how often do you update?

Enquiring minds want to know...

21 Aug 2003, 11:34 PM	#1
DrStrabismus The "e" in e-mail Join Date: May 2002 Posts: 2,804	Virus checking and .pif According to the BBC website sobig carries a .pif file. Isn't this in the same class as xxx.jpg.exe and "xxx .exe " i.e. shoudn't .pif files be trapped by the basic vius checking.

22 Aug 2003, 12:20 AM	#2
vidvandre Cornerstone of the Community Join Date: Dec 2002 Location: Sørumsand(!), Norway Posts: 625	I've spotted the Sobig-F disguised as a scr...

22 Aug 2003, 11:41 AM	#3
Jeremy Howard Ultimate Contributor Join Date: Sep 2001 Location: Australia Posts: 11,501	We've been blocking both .scr and .pif for the last few days. We'll probably keep these blocks in the long-term, since they're in the same category as ..exe, as you say - dangerous extensions with few valid purposes.

22 Aug 2003, 02:00 PM	#4
bitequator The "e" in e-mail Join Date: Apr 2003 Location: USA Posts: 2,978	Just curious, so it seems many mail AVs (like FM's KAV and Runbox's and others) have trouble stopping Sobig (or maybe just the lastest variant), even now? We've had a wee bit of trouble (again) this week, with the latest Sobig.F variant, on our Symantec AV-protected Exchange at work... P.S. .pif and .scr have been used since the very first Sobig variant IIRC...

22 Aug 2003, 02:26 PM	#5
fastashell Essential Contributor Join Date: Jan 2003 Location: Currawang, NSW, Australia Posts: 261	[QUOTE ....... We've had a wee bit of trouble (again) this week, with the latest Sobig.F variant, on our Symantec AV-protected Exchange at work... ....... [/b][/quote] I'd be interested to hear a little more about this. I'm using Symantec corporate edtion to protect the servers, workstations and Exchange. As far as I can tell it's doing it's job so far. I did some system wide scans on the network and found 4 infected files that had slipped through somehow but the scans caught and killed them. What sort of trouble are you having? Do you have the latest version and how often do you update? Enquiring minds want to know...