[Esd-l] Signature to trap Mimail.C (fwd)

John D. Hardin jhardin at impsec.org
Thu Nov 6 09:00:11 PST 2003

On Wed, 5 Nov 2003, Peter Warasin wrote:

> On Wed, 2003-11-05 at 00:47, John D. Hardin wrote:
> are you sure this signature (MiMail.C) is correct?
> i consider this supplements:
> * > 10000
> * < 50000
> * ^From:.*james@
> * ^Subject:.*our private photos
> (information from the symantec homepage)
> what do you think?

That recipe was mailed to me privately and forwarded to the list with
permission. I haven't looked to see if I have any trapped in my
quarantine so I can't comment at the moment.

 John Hardin KA7OHZ    ICQ#15735746    http://www.impsec.org/~jhardin/
 jhardin at impsec.org                        pgpk -a jhardin at impsec.org
 key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
 "To disable the Internet to save EMI and Disney is the moral
  equivalent of burning down the library of Alexandria to ensure the
  livelihood of monastic scribes."
                                    -- John Ippolito of the Guggenheim
   41 days until The Return of the King

More information about the esd-l mailing list