Re: hack for filtering "i love you" worm

[Bruce Guenter]

On Thu, May 04, 2000 at 07:28:32PM -0400, Searcher wrote:
> >   exit(31) if /name="LOVE-LETTER-FOR-YOU.TXT.vbs"/o;
> 
> Am I missing something here?
> 
> Anyone can rename that .vbs to what ever they want and send it around again
> so wouldn't it be more efficient to filter all .vbs attachments?

Nope, you're exactly right.  However, the question was, how do I filter
the "ILOVEYOU" worm, and the above is a quick (and somewhat dirty)
answer.  If you know how to identify VBS source, with the absence of a
MIME type, please tell us.  I intend to do this for my employers, so I'm
not just being facetious.
-- 
Bruce Guenter <[EMAIL PROTECTED]>                       http://em.ca/~bruceg/