topic Re: IDS and MYDOOM.BB in Network Security https://community.cisco.com/t5/network-security/ids-and-mydoom-bb/m-p/328009#M97062 <HTML><HEAD></HEAD><BODY><P>Is the sensor healthy? Is it generating any other alarms? What antivirus software are you using on the email server? What exactly is the antivirus software identifying the suspect attachments as? Do you have any file samples that you could provide? Please email me directly at <A href="mailto:mcerha@cisco.com">mcerha@cisco.com</A> if privacy is a concern. If you send a live virus sample, please put it in a password protected ZIP archive before sending.</P></BODY></HTML> Thu, 17 Feb 2005 22:36:16 GMT mcerha 2005-02-17T22:36:16Z IDS and MYDOOM.BB https://community.cisco.com/t5/network-security/ids-and-mydoom-bb/m-p/328008#M97060 <P>I have an Exchange server that is getting bombarded with MYDOOM.BB viruses. The server virus software is detecting these, but we would like to determine the source. However, my IDS 4215 which is monitoring that network segment is not alarming at all. I have it updated with the S145 updates that are supposed to detect MYDOOM.BB virus activity.</P><P></P><P>Any ideas as to what's going on?</P><P></P><P>- Dave</P> Sun, 10 Mar 2019 09:17:01 GMT https://community.cisco.com/t5/network-security/ids-and-mydoom-bb/m-p/328008#M97060 davemit 2019-03-10T09:17:01Z Re: IDS and MYDOOM.BB https://community.cisco.com/t5/network-security/ids-and-mydoom-bb/m-p/328009#M97062 <HTML><HEAD></HEAD><BODY><P>Is the sensor healthy? Is it generating any other alarms? What antivirus software are you using on the email server? What exactly is the antivirus software identifying the suspect attachments as? Do you have any file samples that you could provide? Please email me directly at <A href="mailto:mcerha@cisco.com">mcerha@cisco.com</A> if privacy is a concern. If you send a live virus sample, please put it in a password protected ZIP archive before sending.</P></BODY></HTML> Thu, 17 Feb 2005 22:36:16 GMT https://community.cisco.com/t5/network-security/ids-and-mydoom-bb/m-p/328009#M97062 mcerha 2005-02-17T22:36:16Z Re: IDS and MYDOOM.BB https://community.cisco.com/t5/network-security/ids-and-mydoom-bb/m-p/328010#M97063 <HTML><HEAD></HEAD><BODY><P>The signatures in S145 detect the pif and zip file formats associated with the virus Trend Micro identifies as MyDoom.BB. Other virus vendors may label a different variant as MyDoom.BB. Also, can you confirm that the sensor is seeing both sides of the traffic to your sensor? Can you provide a traffic sample that we can use to research this?</P><P></P><P>Thanks,</P><P>Jason</P></BODY></HTML> Fri, 18 Feb 2005 00:25:14 GMT https://community.cisco.com/t5/network-security/ids-and-mydoom-bb/m-p/328010#M97063 micballa 2005-02-18T00:25:14Z