Re: Warning Worm/MyDoom.A1 spreading very fast!

/^UEsDBAoAAAAAA/ REJECT

This body check was made by Chris Scott at Hostorlando and it does very well.

--
Jeff

>
> I'm using this:
>
> /filename="(document|readme|doc|text|file|data|test |message|body).(pif|scr|exe|cmd|bat|zip)"/ REJECT
> infected with W32.MyDoom.A
>
>> Hmm, thanks for the research, I'll see how that goes. I block all but
>> .zip files these days, so I'll have a look at that. If anyone already
>> has robust header_checks or body_checks recipes could they post them in
>> this thread?
>
>
> --
> Michael 'Moose' Dinn, Twisted Pair Network Consulting Incorporated
> dinn@twistedpair.ca // 902 423 4700 (voice) // 902 423 8407 (fax)
>
> Colocate your server in our underground bunker!
>