[Esa-l] Re: Help for HAHAHA

[Andre Kajita - Administrador da Rede]

Greets,

> How should I modify poisoned to best prevent Hybris spread.

Being in a country where 98% of users use Outlook (and co.) and also
in the country that created the "Snow White Porn" (as I call it) I
receive at least 3 a day, all of them .scr.

> I already disallow all exe extensions
> further advice?

Blocking .scr is also useful - it's name variations have .exe or .scr
extensions.  If you're bold enough, save the file and run strings on
it, the name variations are near the end of the file.  BTW, there are
name variations for spanish, english, french and portuguese languages.

Andre.
-- 
Andre Kajita - Administrador da Rede <admin at camarasjc.sp.gov.br>
Camara Municipal de Sao Jose dos Campos - SP
http://www.camarasjc.sp.gov.br