Re: In subject how to detect a word in an EVAL string?

[Benny Pedersen]

On Mon, 21 Nov 2011 22:32:42 +0100, Karsten Bräckelmann wrote:

=?iso-8859-1?B?LlZlbnRhIGRlIENBTkFTVEFTIE5BVklERdFBUyAtIHB1YmyhY2kgZGFk?=

Not "eval", but encoded -- in this case even necessary, rather than an

attempt at obfuscation, because it contains non ASCII letters.

yep its base64 encode string between last two ?

?B? is the sign of mime header for base64

?Q? qotedprintelble

but use ripmime :-)

and create rules from the output