FYI from the Full Disclosure mailing list- re: WMF "Preliminary testing reveals that emails containing WMF files can be blocked by filtering for the MIME-encoded WMF header. This approach works even if the file is called WORD.DOC. The string to check for is:
183GmgAA These 8 bytes appear as the first 8 bytes of a MIME-encoded WMF. Thus, blocking all emails with those bytes in will block all emails containing WMFs. This technique can be used with common spam filters. Regarding web-based WMFs, of the three browsers on this system, only IE knows what to do with WMFs." --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
