Just verifying, Roger, that you saw my message on the rules file I made up.
It appears to work since I can't see any of the mail sent through on the
thread.
------------------------------------------
Rich Griebel
[EMAIL PROTECTED]
http://www.kendra.com
----- Original Message -----
From: Roger Heath <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, November 24, 1999 4:31 PM
Subject: [IMail Forum] PRILISSA Rule?
> > * FEATURE: MELISSA VARIANT PRILISSA ON THE LOOSE
> > Users recently discovered a Melissa virus variant named Prilissa. The
> > virus infects Word 97 documents and spreads by sending the infected
> > document as an email attachment using Microsoft Outlook to the first 50
> > addresses in each address book.
> > The subject line reads "Message From (username)." The text in the
> > body of the message reads "This document is very Important and you've
> > GOT to read this!!!" When a user opens the infected document, the virus
> > disables virus protection security settings, conversion confirmation,
> > and recently opened file list.
> > In addition, the virus triggers on December 25, a Christian holiday.
> > Once triggered, the virus writes a Moslem-related message on the
> > screen, modifies the user's autoexec.bat file and, upon reboot,
> > displays a second Moslem-related message.
> > Most major antivirus software vendors have produced signature files
> > to detect and remove the virus. Be sure to update your files today.
> > http://www.ntsecurity.net/go/2c.asp?f=/news.asp?IDF=179&TB=news
> > http://www.symantec.com/press/1999/n991122b.html
>
> Has any one seen this? Does it use the actual users name or will
>
> S~Message From (username):SPAMBOX
>
> work?
>
> Wondering what is the best rule to use against this?
>
> --
> bcnu
> www.rleeheath.com
> Roger Heath [EMAIL PROTECTED]
>
> advanced internet services and software technology
> advanced concepts in emergency medical technology
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
