RE: [cobalt-users] JS_KAKWORM.A virus [Followup]

["Colin J. Raven" <cjraven@xxxxxxxxxxx>]

> Anyone have a procmail recipe for this yet that they would like
> to share?  I
> am a rookie procmail user and could use some pointers..

In thinking on a slightly deeper level about this, and also re-reading
symantec's
blurb on the subject again,  the recipe I posted earlier might not always
work.

I'm going to do some further reading and post whatever I find to the list.
I'm prepared to say at this point that there perhaps may not be a 100%
procmail-driven solution. I'm going to grab a sample of the worm and see if
it could be trapped by a known MIME boundary or similar recurring pattern.
If a pattern exists it can be caught.

To console you (lest you despair), almost every known virus has a pattern of
some kind. The trick is to be able to identify it.
Groetjes,
-Colin
--
Colin J. Raven