dealing with email from "Mydoom" worm

[Eric Wood]

Bill Wohler wrote:
> Fred Yankowski <fred at ontosys.com> writes:
> name (or filename) parameter is on the same line
> as  the Content-Type or Content-Disposition header field or not

>     :0 B:
>     * ^Content-Transfer-Encoding:.*base64
>     * ^Content-(Type|Disposition):.*$?.*name
>     *=.*\.(bat|cmd|exe|pif|scr|zip) spam/exe/.

Bill,
I'm glad you sent that email.  I've been wondering how to catch newlines
with a $.

-eric wood