Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!


Click here to return to the 'Create a Mail rule to block the w32.sobig.f spam worm' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
Create a Mail rule to block the w32.sobig.f spam worm
Authored by: jason.flores on Aug 20, '03 07:00:34PM

Have a similar problem. I look for a paticular part of the mime encoded attachment. If it is there I delete the message.

So I set to check message content for the following string:

TVqQAAMAAAAEAAAA

Look at the raw source of the message, that string above is the first part of the encoded attachment.

My wife has been getting a message for the last couple of days with a lot of different subjects, from addresses, and attachment file names and extensions (so far .scr, .pif and .exe). Searching for the above has grabbed everyone sofar (over 200 now).



[ Reply to This | # ]