Sobig.F@mm.enc

[Antony Stone]

On Sunday 07 September 2003 3:34 pm, Rose, Bobby wrote:

> I'm the same way.  Sobig is being caught for the most part but you have
> different versions going on here.  You have mm and mm.enc.  Enc is where
> it's encoded into the mime header.

Please can somebody explain to me what this means?   Are you saying that a
virus can be encoded in a MIME header, rather than (as is usual) in a MIME
body to which the header refers?

I don't know much abut MIME encoding formats, but on the basis that the Sobig
virus files I've seen are generally around 70kbytes in size, this suggests
something very strange about what can be fitted into a MIME header...?

Antony.

--

Wanted: telepath.   You know where to apply.