Just threw this together based on info from Sybari:
-------------------
W32/[EMAIL PROTECTED]
E-mail Subject:
-------------------
don't be late!<30 spaces><random characters>
E-mail Body:
-------------------
Will meet tonight as we agreed, because on Wednesday I don't think I'll make
it,
so don't be late. And yes, by the way here is the file you asked for.
It's all written there. See you.
<random characters>
E-mail Attachments:
-------------------
readnow.zip
readnow.doc.scr
-------------------
header MY_HS_MIMAIL_E Subject =~ /don't be late\!\s{30}\w+/i
describe MY_HS_MIMAIL_E Mimail-E virus
score MY_HS_MIMAIL_E 10.0
-matt
-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive? Does it
help you create better code? SHARE THE LOVE, and help us help
YOU! Click Here: http://sourceforge.net/donate/
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
