So is this a sobig specific string for infected files?
On Wednesday, August 20, 2003, at 03:48 AM, Alun wrote:
> if $message_body contains
> "AAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZS
> BydW4gaW4g"
> then
> logfile "/tmp/virus.log"
> logwrite "$tod_log blocked to $recipients from $sender_host_address"
> seen finish
> endif