[Esd-l] SWEN identifier: TO/FROM/SUBJECT

Scott Taylor scott at skot.org
Wed Sep 24 02:22:52 PDT 2003

On Tue, 23 Sep 2003, John Downing wrote:

> The uppercase TO/FROM/SUBJECT headers are NOT an "if and only if" marker 
> for the swen worm. I have quarantined email with swen attachments that have 
> both normal and all uppercase headers.

Same here.  However, the attachment always starts with "TVqQAAMAAAAEAAAA".
Although, I fail to see what difference it makes as John's Sanitizer rules 
pick it up every time.

More information about the esd-l mailing list