I have come up with a filter that catches the SWEN virus emails and bounces. The only false positives in the last three days have come from CNN.com being caught on line 3. They are using and Iframe and also include a link to a javascript (what are they thinking!).
BODY 0 CONTAINS <BR><BR><BR>Message follows:<BR><BR> BODY 0 CONTAINS <BR><BR><BR>Undeliverable to BODY 0 CONTAINS <iframe src= BODY 0 CONTAINS Run attached file. Choose Yes on displayed dialog box. BODY 0 CONTAINS Run attached file BODY 0 CONTAINS qmail program BODY 0 CONTAINS Message from microsoft.com BODY 0 CONTAINS I'm afraid I wasn't able to deliver your message to one or more destinations BODY 0 CONTAINS I'm afraid the message returned below could not be delivered to the following addresses BODY 0 CONTAINS I'm sorry I wasn't able to deliver your message to one or more destinations BODY 0 CONTAINS I'm sorry the message returned below could not be delivered BODY 0 CONTAINS I'm sorry to have to inform you that I wasn't able to deliver your message to the following addresses SUBJECT 0 CONTAINS Abort Annoucement SUBJECT 0 CONTAINS Abort Message SUBJECT 0 CONTAINS Bug Advise SUBJECT 0 CONTAINS Current Network Patch SUBJECT 0 CONTAINS Current Security Patch SUBJECT 0 CONTAINS Error Advise SUBJECT 0 CONTAINS Internet Security Upgrade SUBJECT 0 CONTAINS Last Internet Security Pack SUBJECT 0 CONTAINS Last Internet Security Patch SUBJECT 0 CONTAINS Last Internet Security Upgrade SUBJECT 0 CONTAINS Last Microsoft Security Patch SUBJECT 0 CONTAINS Last Net Critical Pack SUBJECT 0 CONTAINS Last Network Security Upgrade SUBJECT 0 CONTAINS Last Network Security Patch SUBJECT 0 CONTAINS Latest Microsoft Critical Update SUBJECT 0 CONTAINS Microsoft Critical Update SUBJECT 0 CONTAINS Microsoft Upgrade SUBJECT 0 CONTAINS Network Update SUBJECT 0 CONTAINS New Internet Critical Update SUBJECT 0 CONTAINS New Microsoft Critical Patch SUBJECT 0 CONTAINS New Microsoft Patch SUBJECT 0 CONTAINS New Net Critical Pack SUBJECT 0 CONTAINS New Net Critical Patch SUBJECT 0 CONTAINS New Network Critical Update SUBJECT 0 CONTAINS New Network Critical Upgrade SUBJECT 0 CONTAINS New Network Security Patch SUBJECT 0 CONTAINS New Security Update SUBJECT 0 CONTAINS Newest Internet Pack SUBJECT 0 CONTAINS Newest Internet Upgrade SUBJECT 0 CONTAINS Newest Microsoft Pack SUBJECT 0 CONTAINS Newest Microsoft Security Patch SUBJECT 0 CONTAINS Newest Microsoft Upgrade SUBJECT 0 CONTAINS Newest Net Patch SUBJECT 0 CONTAINS Newest Network Critical Update SUBJECT 0 CONTAINS newest pack Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] (805) 520-5800 x7332 ____________________________________ Changing the way industry works. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
