Hi,

Good point, but one problem will occur on any larger network. I'm working at the helpdesk at our company and I have about 1200 people to help out if they should need it. About perhaps 200 of these would know how to rename a file. 100 of these would know that it, in fact, is an .exe file they just resieved. that would give me about 1000 potential calls to handle if an .exe file was sent out to the users via mail. Sure, we could just add it to our login-script, but all comanies don't work this way.

What one could do, although this is theoritical and won't help in many cases, is to scan for known patterns. How many scripts do you have that reads the Outlook addressbook? Or scans for mIRC? Sure, this would demand some work and many scripts would be missed, but if this would have been done after the Melissa (and quite a few others) virus the ILOVEYOU would have been found.

Stefan Axelsson

stefan.axelsson (at) flygt (dot) com [email concealed]

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/27/1676#1676