Re: Current "Swen" worm attack

["Randy Brukardt" <randy@rrsoftware.com>]

Preben Randhol wrote:
> Note that the worm grabs e.mail address from USENET groups such as thi
> groups. I got 3 copies of each virus as it had managed to find three
> addresses from the news groups. However I managed to put a stop to it by
> grepping (at the ISP) for a patterns in the base64 encoding of the exe
files
> and sending the mails containing them into /dev/null.
>
> First day I got about 200-300 Mb of this virus.

Glad to hear that others are getting it worse. I've "only" gotten about 100
MB of it so far (about 1200 copies). The problem actually has been helped by
the fact that my antivirus (even though completely up to date) doesn't catch
all of them. That has let me use my spam filter to automatically delete them
rather than fill up the mail server's disk with quarentines.

But a couple more attacks and we're all going back to paper and pencil...

                     Randy.