Will MailScanner pickup the W32/Bagle-Q virus? Changed Rule!

Holger Gebhard gebhard at EPOST.DE
Thu Mar 18 23:44:11 GMT 2004

Sorry... There is one little mistake in the posted rule...
Changed the ...[1-9]... to ...[0-9]...

It's late ;-)

The changed rule:

rawbody  BagleQ_Found /(?:\<object\s{1,3}style\=\Sdisplay\:none.{1,5}
describe BagleQ_Found Worm Bagle-Q found
score    BagleQ_Found 10.0


More information about the MailScanner mailing list