On Tue, 2004-01-27 at 02:41, Richard Beyer wrote: > Something to catch test.zip, readme.zip and body.zip (the most common > ones it appears to be using at the moment). >
Symantec has a lot of information on the attachments it uses, although the message body might be easier to write accurate rules for. See "9. The email will have the following characteristics:" http://www.sarc.com/avcenter/venc/data/[EMAIL PROTECTED] - Jon -- [EMAIL PROTECTED] Administrator, tgpsolutions http://www.tgpsolutions.com
signature.asc
Description: This is a digitally signed message part
