> Are you using this one (body check)? > > /^UEsDBAoAAAAAA/ DISCARD W32.MyDoom.A
Jeff, yes, as well as, I now addded as below: BUT, I still keep getting (like, to my own email address) quite a few 30k zip files, which, I guess, are the mydooms. should that stop the ZIPs ? for now, I'm dropping all the ZIPs till I can sort this out Voytek ... /^UEsDBAoAAAAAA/ DISCARD bc5 # archives.neohapsis.com/archives/postfix/2004-01/2073.html /^ Test =\)$/ REJECT infected: I-Worm.Bagle # addded 29/01/04 /^RSLxwtYBDB6FCv8ybBcS0zp9VU5of3K4BXuwyehTM0RI9IrSjVuwP94xfn0wgOjouKWzGXHVk3qg$/ DISCARD VIRUS (sobig.f) /^ZGUuDQ0KJAAAAAAAAAB\+i6hSOurGATrqxgE66sYBQfbKATvqxgG59sgBLerGAdL1zAEA6sYBWPXV$/ DISCARD VIRUS (W32/[EMAIL PROTECTED]) /AAAAAAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4g/ DISCARD VIRUS (W32/[EMAIL PROTECTED]) /^(UEsDBAoAAAAAA|ApIAUCZKAEAD\/bJpmiwQBPQl6AEAS85pmm7ZH8gqwAO4sKimaZqmoJiQiICapmmaeHBoYFhQzWCf)/ DISCARD VIRUS (W32/[EMAIL PROTECTED]) -- SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/ Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
