procmail
[Top] [All Lists]

Re: virus recipe for MyDoom

2004-01-27 09:08:56
Dallman Ross writes:
On Tue, Jan 27, 2004 at 12:48:57PM +0000, John Conover wrote:

There are probably more extensions that Microsoft Outlook will
consider, in one form or another, executable:

    http://www.johncon.com/john/QuarantineAttachments/

may be of some help-there is a click'ie for the script fragment.

Hmm.  I am loathe to add ZIP to the list of bad extensions.
My purpose has never been to stop any and all attachments.
Doing so would be satisfied by a much simpler recipe.


Yea, I agree with you, but Lookout does not look at the file
extensions to decide whether it is executable, (and that's a big
problem.) It looks for a signature in the first few characters of the
file. For example, one of the executable files some of the MyDooms
carries an extension of ".txt" and the only way to be sure is to unzip
it, and look at the header.

But you are right-its a big pain.

Just IMHO ...

        John

-- 

John Conover, conover(_at_)rahul(_dot_)net, http://www.rahul.net/conover/

_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail