Re: IL0VEY0U has mutated

2000-05-04-18:51:48 Jerry Preeper:
> If I can ask real quick, will this recipe in an rc file catch anything with
> a .vbs file?
>
> :0 f
> * ^Content-.*: .*\.vbs
> |formail -A "X-Spam-Reject: rc.viruses - vbs attached"
I think you need to make that start with

        :0 fHB

so it'll egrep the "body" as well; the Content header will only show
up within the RFC 822 header if the "attachment" is the first one in
the message, which it generally isn't in these worms.

-Bennett

pgpxfQrtMZVki.pgp
Description: PGP signature