We seem to have gotten a healthy dose of the klez virus on the windows network
where I work. The virus is stopped at the desktop by a virus scanner, but I
would think that one would want to stop it before it got that far.
At about the same time this happened, an article ran on slashdot about the
virus and some posted this response, and I quote:
>
This regexp filter (suitable for perl and procmail) has blocked 2.7GB of Klez
mail on our server (we're a web host) since May 1st.
^135AAItEjhyJRI8ci0SOGIlEjxiLRI4UiUSPFItEjhCJRI8Qi 0SODIlEjwyLRI4IiUSPCItE$
Enjoy.
>
So my question is about the above regex; to my slightly trained eye the above
filter is beginning of the line-string sequence-end of the line. IOW, a line
just like the above with the caret on the front and the dollar sign on the
end gone. Is this correct? And I assume that I would look for this one line
string in the body of the message.
Has anyone else seen anything like this? Kind of a digital signature ....
tanks for any help
This archive was generated by hypermail 2.1.3 : Fri Aug 01 2014 - 19:00:11 EDT