On Wed, 20 Aug 2003 10:17:16 +0200, [EMAIL PROTECTED] said: > /see attached file for details/ REJECT > > ever since, I've not had a single one coming through.
The reason this one works for the worm writers is because it's standard English usage - as a result, it's *very* prone to false positives. And you give no indication of *why* the file was rejected, so the sender has no idea that if he re-sends but says "Hey check out the file for the long version" instead it will get through. If you're going to do this, scan for something that's almost certainly unique to the worm(s) you're fighting, and give the user a hint what the problem is....
pgp00000.pgp
Description: PGP signature