what to do about Windows email worms

[jullrich at sans.org (Johannes B. Ullrich)]

Well, when Sobig went around, I came up with an 'Anti-Virus'
policy, that if implemented widely would radically cut down
on the spread of viruses:

http://isc.sans.org/antivirus.pdf

Have yet to find an organization that implemented it to 
see how they did with 'MyDoom'.

(BTW: I don't think 'MyDoom' uses any particular Windows bug.
You could send binaries in pine if you want, as long the user
will execute it, you are all set)




-- 
CTO SANS Internet Storm Center               http://isc.sans.org
phone: (617) 837 2807                          jullrich at sans.org 

contact details: http://johannes.homepc.org/contact.htm
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://lists.blu.org/pipermail/discuss/attachments/20040127/ebdcc676/attachment.sig>