RE: Warning Worm/MyDoom.A1 spreading very fast!

On Mon, 26 Jan 2004, Tom Warfield wrote:

> Yeah im trying to think of a decent procmail script to remove
> these...but I don't think its possible unless you just block the .zip
> files completly

It's not always a zip, it does other extensions as well, from a small
sampling:

8 bat
13 cmd
30 exe
130 pif
117 scr
473 zip
..

(Look for strings in the bottom of the message attachments if you want to
procmail it- strings there don't change as much.)

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@patriot.net which may have no basis whatsoever in fact."
probertson@trusecure.com Director of Risk Assessment TruSecure Corporation