Abigail Marshall wrote:
This works for W32.mimail.C - but I've only caught two instances: # W32.Mimail.C@mm# Testing, this is a new worm described at # http://www.sarc.com/avcenter/venc/data/w32.mimail.c@xxxxxxx:0 * <25000 * H ?? Subject:.*our private photos * B ?? photos\.zip { LOG="W32.Mimail.C@mm":0 /var/dump/MimailC}
Hi Abigail, you should add "don't be late!" which comes with message.zip, it's another Mimail variant, someone called it -E
====================================================================== This is <vps-mail@xxxxxxxxxxxx> <http://www.perlcode.org/lists/> ======================================================================