This is another virus spammed from the Storm botnet.
Matt
Marc Catuogno wrote:
Just an FYI, I just got this link claiming this is a trojan downloader
http://antivirus.about.com/b/a/257941.htm
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Wednesday, September 12, 2007 1:07 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter for Football
You could create a filter that looks for 2 identifiers in the email then
score the filter in the global.cfg.
1. A phrase or word
2. The fact there is an IP as a URL
Example:
MINWEIGHTTOFAIL 2
ANYWHERE 1 PCRE (?i:football|games?)
BODY 1 PCRE
(http://((?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9
]|[01]?[0-9][0-9]?))
David
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mon
Mariola - Rubén
Sent: Wednesday, September 12, 2007 11:28 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Filter for Football
This is only a sample. The IPs are different. At least I have counted about
20 different subjects that declude has detected like spam and for each
subject many combinations of bodies. 40% of the messages blocked by declude
are of this type.
----------
Subject: NFL Season Is Here!
Body:
The time has come for... FOOTBALL!
Don't miss a single game because you don't have the info you needed.
Have all the details for every game with our free game tracking system:
http://x.x.x.x/
----------
Subject: Do you have your NFL Game List?
Body:
Football is back, Life may resume again!
Let us keep you on top of every game everyday.
Get all the info you need from our online game tracker:
http://x.x.x.x/
----------
Subject: NFL Game List
Body:
We interrupt this life to bring you.....FOOTBALL!
Know all the games, what time, what channel and the stats.
Stay informed for every game with our free game page:
http://x.x.x.x/
----------
Subject: FOOTBALL! Are You ready?
Body:
Season is open.... and we do mean FOOTBALL!
Know all the games, what time, what channel and the stats.
Stay informed for every game with our free game page:
http://x.x.x.x/
----------
Ruben Marti.
Mon Mariola, S.L.
----- Original Message -----
From: David Barker
To: declude.junkmail@declude.com
Sent: Wednesday, September 12, 2007 4:36 PM
Subject: RE: [Declude.JunkMail] Filter for Football
Can you post an example ?
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.