Just FYI the emails themselves do not contain a virus.
Use the attached filter to detect these emails, using Declude JunkMail. You
must be using at least Declude 4.3.46 to take use the regular expression
filtering.
David Barker
VP Operations | Declude
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
E: [EMAIL PROTECTED]
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bob
McGregor
Sent: Tuesday, July 24, 2007 12:26 PM
To: Declude-List
Subject: [Declude.Virus] removing js/psyme
We have had quite a few people open the ecard messages and are now infected
with this virus.
Anyone know of a freebe that will remove this one? Currently, the only way
we're able to remove it is safe mode and avg.
thanks, bob
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
BODY END NOTCONTAINS SEEING YOUR CARD
BODY 20 PCRE
(http://((?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/)
BODY 5 PCRE (?i:ecard)
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
