On Thu, Aug 21, 2003 at 11:14:33AM +0200, Dallman Ross wrote:
The virus does use its own SMTP server, however, so finding such
syntax flaws is definitely a good tack. Unfortunately, I can't
research further, because my ISP has suddenly started site-wide
blocking with no opt-out -- something it promised it would never
do.
I've sifted through hundreds of these Sobig.F messages, and they all
have the same X-Mailer header:
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
...2600 d00d ;)
I doubt any OE client uses that format :)
--
Robert Arnold
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail