SCOUG-HELP Mailing List Archives

<< Previous Message << >> Next Message >>

Date:	Tue, 27 Jan 2004 06:05:08 PST8
From:	Peter Skye <pskye@peterskye.com >
Reply-To:	scoug-help@scoug.com
To:	scoug-help@scoug.com
Subject:	SCOUG-Help: well-hidden virus - MyDoom

Content Type: text/plain

=====================================================
If you are responding to someone asking for help who
may not be a member of this list, be sure to use the
REPLY TO ALL feature of your email program.
=====================================================

Peter Skye wrote:
>
> > Just got a virus email with a well-hidden . . .
>
> It was the brand-new MyDoom virus.

I received about 2 MB of these things overnight.

Setting up a filter should be done on the body, not the header, because
the thing spoofs other peoples' email addresses so you also receive it
as a "bounceback" when the To address fails or it is refused by a
virus-blocking email server.

My Netscape 2.02 doesn't allow filtering on the body, but the following
string should work for a body filter so give it a try:

UzMjAmqZpurgnsKyoo

The above string is part of the zipped attachment containing the virus.
Just about any part of the attachment should work as a filter string,
though I don't know the format of a Zip file so I recommend you not use
anything in the very beginning of the file because that portion might be
a "standard header" which is on all zip files.

- Peter

=====================================================

To unsubscribe from this list, send an email message
to "steward@scoug.com". In the body of the message,
put the command "unsubscribe scoug-help".

For problems, contact the list owner at
"rollin@scoug.com".

=====================================================

Return to [ 27 | January | 2004 ]

SCOUG, Warp Expo West, and Warpfest are trademarks of the Southern California OS/2 User Group. OS/2, Workplace Shell, and IBM are registered trademarks of International Business Machines Corporation. All other trademarks remain the property of their respective owners.