Re: Procmail recipe for new Vote virus

["Rodolfo J. Paiz" <rpaiz indahaus com>]

At 10/1/2001 03:51 PM -0400, you wrote:
> KM>> ># Block the Nimba (W32 Nimda A mm) worm.
> KM>> >:0 B
> KM>> >*
> KM>> >^Content-Type:.*(audio\/x-wav|attachment|inline|multipart\/related|al 
> ternative);
> KM>> >*name="(README|readme).(exe|exe)"
> KM>> >$ABYSS
> KM>>
> KM>> where previously defined ABYSS=/dev/null. Note that this should be five
> KM>> lines only; the third line may wrap in email but should be corrected.
> KM>>
> KM>> The question? Can I simply change (README|readme) to (WTC|wtc) to 
> stop the
> KM>> Vote virus? Should I also change the Content-Type? If so, to what?
>
> Keeripes... all this name dropping and familiarity... it... it's so
> touching... sniff... :-)

Err... Chuck, since you're around, about the original question there... 
will changing the filename alone stop the Vote virus, or must I change 
Content-Type as well? If so, to what?

Anyone...?
Anyone...?
Bueller...?


--
Rodolfo J. Paiz
rpaiz indahaus com