Braindead worms

["John D. Hardin" <jh...@impsec.org>]

FYI, a couple of headers the executable-attachment filters trapped
today on a system I assist with:

> From ws3@netshelter.adtrix[2].txt  Thu Jul  6 10:36:55 2006
> Return-Path: <ws3@netshelter.adtrix[2].txt>

> From drive\windows\cookies\ws3@tripod[1].txt  Thu Jul  6 10:36:51
2006
> Return-Path: <drive\windows\cookies\ws3@tripod[1].txt>

...sigh.

Is it worth a rule to catch nonsense like this? I guess their MTA has
the "sender domain must resolve" checks turned off...

--
 John Hardin KA7OHZ    ICQ#15735746    http://www.impsec.org/~jhardin/
 jhardin@impsec.org    FALaholic #11174    pgpk -a jhardin@impsec.org
 key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
  ...every time I sit down in front of a Windows machine I feel as
  if the computer is just a place for the manufacturers to put their
  advertising.                              -- fwadling on Y! SCOX
----------------------------------------------------------------------