[Esa-l] Re: WORM WARNING

[John D. Hardin]

On Sat, 17 Mar 2001, John D. Hardin wrote:

> This one may prompt you to adopt a "poison *.EXE" policy.
> 
> http://www.sarc.com/avcenter/venc/data/w32.magistr.24876@mm.html
> 
> Fortunately it doesn't appear to be widespread.

If you do not wish to implement a "poison *.EXE" policy, you may wish
to add the following to the poisoned executables list:

    *\s+.exe

This should be a reasonable middle ground.

Also the vague descriptions of the poisoned attachment make it sound
like the double-extension-with-spaces rules posted a few weeks back
would also successfully trap it.

--
 John Hardin KA7OHZ   ICQ#15735746   http://www.wolfenet.com/~jhardin/
 jhardin at wolfenet.com      pgpk -a finger://gonzo.wolfenet.com/jhardin
  768: 0x41EA94F5 - A3 0C 5B C2 EF 0D 2C E5  E9 BF C8 33 A7 A9 CE 76 
 1024: 0xB8732E79 - 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
  Your mouse has moved. Your Windows Operating System must be
  relicensed due to this hardware change. Please contact Microsoft
  to obtain a new activation key. If this hardware change results in
  added functionality you may be subject to additional license fees.
  Your system will now shut down. Thank you for choosing Microsoft.
-----------------------------------------------------------------------
   3 days until Mir deorbits