Some SpamAssassin rules I’m using to combat the MyDoom email virus:
January 27th, 2004
Some SpamAssassin rules I’m using to combat the MyDoom email virus: (not
foolproof by any means)
rawbody DS_MYDOOM_ENCODING /charset="Windows-1252″/
rawbody DS_MYDOOM_ATTACH_1 /filename="(message|file|text)\.zip"/
rawbody DS_MYDOOM_ATTACH_2 /filename=”.*\.(pif|scr)"/
rawbody DS_MYDOOM_BASE64_1
/^TVqQAAMAAAAEAAAA\/\/8AALgAA
AAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/
rawbody DS_MYDOOM_BASE64_2
/^UEsDBAoAAAAAAKYJPDDKJx+eAFg
AAABYAAAKAAAAcmVhZG1lLnNjck1akAADAAAABAAAAP\/\/AAC4/
score DS_MYDOOM_ENCODING 2.0
score DS_MYDOOM_ATTACH_1 3.0
score DS_MYDOOM_ATTACH_2 4.0
score DS_MYDOOM_BASE64_1 3.0
score DS_MYDOOM_BASE64_2 3.0