[Esa-l] Re: Idea: Multiple extension detector

Brett Glass brett at lariat.org
Tue Jun 13 18:50:24 PDT 2000


At 02:26 PM 6/13/2000, Quinn Yost wrote:
  
>Actually, the ideal would be to trap on  
>*.${MANGLE_EXTENSIONS}.${MANGLE_EXTENSIONS}

No, because in this ruse, the first extension is NOT one that's used
by executable files. For example, the "ILOVEYOU" worm used
loveletter.txt.vbs.

--Brett





More information about the esd-l mailing list