Re: [Full-Disclosure] Swen Really Sucks

["Brent J. Nordquist" <b-nordquist@xxxxxxxxxx>]

On Wed, 24 Sep 2003, Peter Busser <peter@xxxxxxxxxxxxxxxxx> wrote:

> I use several procmail rules to filter out domains (microsoft.com,
> msdn.com, etc.) in From: and From, To: (e.g. microsoft.com) and certain
> words in the subject (e.g. Microsoft). Since the virus depends on
> looking like an authentic message, it can't do too much randomisation of
> the domains and subject lines. Of course the filtering is not perfect,
> but it still reduces the number of virus messages hitting the inbox.

Someone pointed out yesterday that Swen has the header "SUBJECT: " in all
upper-case, as opposed to the usual mixed-case "Subject: ".  I looked at
all the ones I've received, and sure enough, they're all upper-case.  
That might be another telltale you can use if you're taking the procmail
approach.

-- 
Brent J. Nordquist <b-nordquist@xxxxxxxxxx> N0BJN
Other contact information: http://kepler.acns.bethel.edu/~bjn/contact.html
* Fast pipe * Always on * Get out of the way - Tim Bray http://tinyurl.com/7sti

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html