[unisog] MyParty

Jose Nazario jose at biocserver.BIOC.cwru.edu
Mon Jan 28 21:10:07 GMT 2002


On Mon, 28 Jan 2002, Anderson Johnston wrote:

> We are getting slammed with the My Party worm.  As near as we can
> tell, it's showing up in two flavors.  There is a relatively obvious
> one that has the subject "new photos from my party!"

i have been blocking this with a sendmail rule:

HSubject: $>Check_Subject

D{PtyPat}new photos from my party!
D{PtyMsg}New MyPhotos worm.

R{PtyPat} $*            $#error $: 553 ${PtyMsg}
RRe: {PtyPat} $*        $#error $: 553 ${PtyMsg}


this will help slow down the dumber, initial variant with the status
subject line.

simply insert this as decribed here:

http://biocserver.BIOC.CWRU.Edu/~jose/iloveyouhack.txt

seems to help give you more time to upgrade everything else, its no
replacement for desktop security. i haven't seen the newer variants so i
can't help you there. it may be using a static MIME content start line, so
.. keep that in mind.

hope this helps some of you,

____________________________
jose nazario						     jose at cwru.edu
	      	     PGP: 89 B0 81 DA 5B FD 7E 00  99 C3 B2 CD 48 A0 07 80
				       PGP key ID 0xFD37F4E5 (pgp.mit.edu)



More information about the unisog mailing list