Re: hack for filtering "i love you" worm

[Bruno Wolff III]

On Fri, May 05, 2000 at 02:56:38AM -0600,
  Neil Schemenauer <[EMAIL PROTECTED]> wrote:
> On Thu, May 04, 2000 at 07:28:32PM -0400, Searcher wrote:
> > >   exit(31) if /name="LOVE-LETTER-FOR-YOU.TXT.vbs"/o;
> > 
> > Am I missing something here?
> 
> Nothing except that fact that the real solution is to fix the
> broken mail clients.  IMHO, virus scanners and the like are
> fundamentally broken.

I agree with that. Since this one actually burns people, maybe people
will learn not to run attachments unless they are expecting them and they
are from someone they have a good reason to trust.

I am suprised that we aren't already seeing viruses that mutate by encrypting
themselves (to make virus scanning harder by greatly reducing the fixed part
of the payload) and using varients in the deliverly envelope at each
iteration. Using the same filename for the attachment and the same subject
each time the virus transmits itself makes it too easy to detect the message.