[linux-elitists] Swen

Dragan Stancevic visitor@xalien.org
Tue Sep 23 16:05:12 PDT 2003

On Monday 22 September 2003 12:09, Andrew Morton wrote:
> My problem is that my upstream MTA strips the attachment off before I get
> the email.  It's using something called `mimedefang', which really should
> have added a new header to the email, but didn't.

Ah, I see. Sou you only get the mail message and no other junk. Perhaps an 
easier rule would be to check message for:

"MS Internet Explorer, MS Outlook and MS Outlook Express", 

Another one would be to check the body for:
date +"%B, %Y Cumulative Patch\" update which"

The virus is designed to have the "current date" so "the patch" doesn't look 
outdated e.g. next month.

But looking at your list it looks pretty complete compared to the keywords it 
uses. :-)

Peace can only come as a natural consequence
of universal enlightenment. -Dr. Nikola Tesla

More information about the linux-elitists mailing list