Sobig.F resurgence

[Raymond Dijkxhoorn]

Hi!

> What Sendmail rule are you using to block them?
> We've been rejecting the most offending IP addresses with the access
> database, but as you might expect... It's a little like a moving target.

# LOCAL_RULESETS
#
HSubject: $>Check_Subject
D{SobigPattern1}Re: That movie
D{SobigPattern2}Re: Wicked screensaver
D{SobigPattern3}Re: Your application
D{SobigPattern4}Re: Approved
D{SobigPattern5}Re: Re: My details
D{SobigPattern6}Re: Thank you!
D{SobigPattern7}Re: Details
D{SobigPattern8}Your details
D{SobigPattern9}Thank you!
D{SobigPattern10}Use this patch immediately !
D{SobigMesg}Hernoem het onderwerp van deze e-mail en stuur deze opnieuw. De omschrijving duidt mogelijk op een virus en is geblokkeerd. Please re-phrase the subject of this message and try again - Possible worm - BLOCKED - See http://www.multikabel.nl/viruswarning
SCheck_Subject
R${SobigPattern1}               $#error $@ 5.7.1 $: ${SobigMesg}
R${SobigPattern2}               $#error $@ 5.7.1 $: ${SobigMesg}
R${SobigPattern3}               $#error $@ 5.7.1 $: ${SobigMesg}
R${SobigPattern4}               $#error $@ 5.7.1 $: ${SobigMesg}
R${SobigPattern5}               $#error $@ 5.7.1 $: ${SobigMesg}
R${SobigPattern6}               $#error $@ 5.7.1 $: ${SobigMesg}
R${SobigPattern7}               $#error $@ 5.7.1 $: ${SobigMesg}
R${SobigPattern8}               $#error $@ 5.7.1 $: ${SobigMesg}
R${SobigPattern9}               $#error $@ 5.7.1 $: ${SobigMesg}
R${SobigPattern10}              $#error $@ 5.7.1 $: ${SobigMesg}

Bye,
Raymond.