Re: [vps-mail] Look out for this one

[Abigail Marshall <webmaster@xxxxxxxxxxxx>]

RF> We just received the following message which appears to be coming from 
RF> Microsoft but when you open the headers it is coming through a mindspring 
RF> account. Would Microsoft be using Mindspring (an Earthlink company) to send 
RF> mail? Not very likely! At any rate, the message is an html webpage from 
RF> Microsoft's site and it has an attachment called "Update8986.exe".

Rae,
It's a virus - Win32.Swen.A.

I've now caught 71 instances of the virus with the following
procmail recipe, and I haven't seen any instances of the
virus bypassing this, so at this point I'm pretty confident the
recipe works


-Abigail



#Win32.Swen.A
#Testing - see http://www3.ca.com/virusinfo/virus.aspx?ID=36939
:0B
* >140000
* <190000
* BTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4ga
/dev/null

======================================================================
Technical questions regarding this list may be sent to
<vps-mail-owner@xxxxxxxxxxxx>. You may request an automated help
response by sending an email with the word 'help' (w/o quotes) in the
BODY of the message (subject is ignored) to <vps-mail-request@xxxxxxxxxxxx>.
======================================================================