Re: [cobalt-users] MyDoom for Windows is being used to attack UINUX Website

["Al-Juhani" <aljuhani@xxxxxxxxx>]

> I still haven't figured out how to block them at "rcpt to" time, but I 
> have some filters locally that you and others could implement in 
> procmail to keep these from getting to your users:
> 
> 1) Filter on subject of "Hi" and attachment of zip file
> 2) Filter on subject of "Re: Hi" and attachment of zip file
> 3) Filter on sender of "MAILER-DAEMON" and attachment of zip file
> 4) Filter on sender of "Mailer-Daemon" and attachment of zip file
> 5) Filter on subject contains "Virus Alert - ScanMail" and attachment of 
> zip file
> 6) Filter on subject contains "Several matches found in Domino 
> Directory" and attachment of zip file.
> 
> I'm sure we'll get a few more signatures to look for as time goes on.

Jeff,

Well just for the purpose of trying to analyze both MyDoom.A and MyDoom.B
worms are available on this website: http://homepages.ihug.co.nz/~mjcarter/
see the link at the bottom of the page.

Al-Juhani