[Esd-l] SWEN identifier: TO/FROM/SUBJECT
scott at skot.org
Wed Sep 24 02:22:52 PDT 2003
On Tue, 23 Sep 2003, John Downing wrote:
> The uppercase TO/FROM/SUBJECT headers are NOT an "if and only if" marker
> for the swen worm. I have quarantined email with swen attachments that have
> both normal and all uppercase headers.
Same here. However, the attachment always starts with "TVqQAAMAAAAEAAAA".
Although, I fail to see what difference it makes as John's Sanitizer rules
pick it up every time.
More information about the esd-l