Tue Sep 23 16:05:12 PDT 2003
On Monday 22 September 2003 12:09, Andrew Morton wrote:
> My problem is that my upstream MTA strips the attachment off before I get
> the email. It's using something called `mimedefang', which really should
> have added a new header to the email, but didn't.
Ah, I see. Sou you only get the mail message and no other junk. Perhaps an
easier rule would be to check message for:
"MS Internet Explorer, MS Outlook and MS Outlook Express",
Another one would be to check the body for:
date +"%B, %Y Cumulative Patch\" update which"
The virus is designed to have the "current date" so "the patch" doesn't look
outdated e.g. next month.
But looking at your list it looks pretty complete compared to the keywords it
Peace can only come as a natural consequence
of universal enlightenment. -Dr. Nikola Tesla
More information about the linux-elitists