Re: NEW VIRUS FOUND PLEASE READ IMPORTANT!!!!!

[Dan Riley <dsr () MAIL LNS CORNELL EDU>]

Daniel Martin <dtmartin24 () HOME COM> writes:
> While this is all well and good (and will work for this virus), it is
> worthless against those vbs virii that randomize their subject lines
> (which happens).  Also, with this method one is constantly reacting to
> virus outbreaks after they happen.  Is there any way to get a sendmail
> rule to block based on the contents of a message - I'm thinking that a
> useful pattern to block on would be the filename of an attachment; if
> the filename matches the perl regexp
>
>        \.\w{2,5}\.(vbs|exe|com|hta|pl|bat|wsh|js)$

If you're willing to install procmail as your mail delivery agent,

        http://www.impsec.org/email-tools/procmail-security.html

can do what you want.

--
Dan Riley                                         dsr () mail lns cornell edu
Wilson Lab, Cornell University      <URL:http://www.lns.cornell.edu/~dsr/>
    "History teaches us that days like this are best spent in bed"