One of my lists got hit yesterday by the so-called Win32/Ska.A worm
<http://www.datafellows.com/v-descs/ska.htm>. This sucker slipped by our
attachment filters because it replicates by uuencoding itself and making
that uuencoded (ie, text file) the BODY of an outgoing mail msg. No MIME or
other info is included with it.
You can filter on the header line it adds:
X-Spanska: YES
Or on the beginning of the uuencoded data, which reads:
begin 644
(I'm filtering, in majordomo, on /^begin 6/i)
Just FYI...
Tom Coradeschi, Info-LabVIEW List Maintainer
<[EMAIL PROTECTED]>
http://k-whiner.pica.army.mil/info-labview/info-labview.html
