[Exim] bugbear worm

Top Page
Delete this message
Reply to this message
Author: Todd Lattimer
Date:  
To: exim-users
Subject: [Exim] bugbear worm
Hi all,

I was wondering if anyone has setup a filter to catch the bugbear worm.
I've tried installing the one below but it doesn't appear to be working.
If anyone has had any luck blocking this worm i'd be keen to know what you
did that got it stopped.

cheers
Todd


#BugBear
if $message_body contains
"TVqQAAMAAAAEAAAA/8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
and $message_body contains
"AAAA4AAAAA4fug4AtAnNIbgBT0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1v"
then
seen finish
endif
# End BugBear