[vps-mail] New virus signature

[Abigail Marshall <abigail@xxxxxxxxxxxx>]

There is a new virus which is a variant of Bagel - it comes
with a zip file with some variant of price*.zip attached,
and there is text in the body that is either the word
"price" alone or "new price".  It is very small - only 9 kb,
so it might get by a filter that is keyed to larger viruses.
I was hit with several instances this morning.


Fortunately, it was very easy for me to isolate a signature
from the files I received,so here's my procmail recipe:


# Delete Files with "Price" Signature
# New virus - comes with price*.zip file
:0B
* <15000
* ^UEsDBBQAAAAIANSBCTE3Aq1SCQIAAD4EAAAKAAAAcHJpY2UuaHRtbI1U34
{
     LOG="Price "
     :0
     /dev/null
)


-Abigail

======================================================================
This is <vps-mail@xxxxxxxxxxxx>       <http://www.perlcode.org/lists/>
Before posting a question, please search the archives (see above URL).