Re: Warning Worm/MyDoom.A1 spreading very fast!

I'm using this:

/filename="(document|readme|doc|text|file|data|test |message|body).(pif|scr|exe|cmd|bat|zip)"/ REJECT
infected with W32.MyDoom.A

> Hmm, thanks for the research, I'll see how that goes. I block all but
> .zip files these days, so I'll have a look at that. If anyone already
> has robust header_checks or body_checks recipes could they post them in
> this thread?


--
Michael 'Moose' Dinn, Twisted Pair Network Consulting Incorporated
dinn@twistedpair.ca // 902 423 4700 (voice) // 902 423 8407 (fax)

Colocate your server in our underground bunker!