[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Fw: [Exim] the 'ILOVEYOU' virus - a simple filter



Try the following (riped from comp.mail.sendmail)

---
# attachments we don't like
CAvbs

# stuff all Content-Disposition: headers to our ruleset
HContent-Disposition: $>CheckContentDisposition

#
# checking content disposition
#

Kbadattach regex -n vbs$

D{noattach} "501 We do not accept vbs attachments - Please attach it as
part of a zip file or send the vbs file as plain text - Contact
postmaster@$j with any questions."

SCheckContentDisposition
Rattachment; filename=$+        $1
R$+                            $: $(dequote $1 $)
R$+$=A                          $#error $: ${noattach}
R$+                            $: $(badattach $1 $: BAD $)
RBAD                            $#error $: ${noattach}
R$*                            $@ OK
---

But this is not perfect and some cases can be missed, It's better
to code it in collect.c.


Ereli <buffer1@barak-online.net> wrote:
> This could be useful.
> 
> ----- Original Message ----- 
> From: Dave Rigby 
> To: exim-users@exim.org 
> Sent: Thursday, May 04, 2000 9:03 PM
> Subject: [Exim] the 'ILOVEYOU' virus - a simple filter
> 
> 
> Hi.
> 
> The ILOVEYOU virus has hit our mail =ervers in the UK, but I managed I implement a filter on exim (hopefully) before much =amage was caused. It's nothing complicated - just redirects all emails with =he appropiate subject "ILOVEYOU" to a specified mailbox. 
>  
> Save this as a filter file on your system:
> # =xim filter
> if $header_subject: is "ILOVEYOU" 
> then
>    deliver suspicious@<yourdomain.com>
> endif
>  
> and set in the main config =/FONT>
> message_filter =STRONG>= <path to filter file> 
> 
>  
> Hope people find this =seful
>  
>  
> David Rigby
>  
> drigby@acquist.co.uk

=================================================================
To unsubscribe, send mail to linux-il-request@linux.org.il with
the word "unsubscribe" in the message body, e.g., run the command
echo unsubscribe | mail linux-il-request@linux.org.il