Hi, I would be more interested in blocking these with exim, before they enter my world. Exim should just not accept any message that has a FROM: header (just for thie next few days, until the problem ebbed down). any ideas? nomeata Am Sa, 2003-09-20 um 19.12 schrieb Ismael Valladolid Torres: > Jarno Elonen just posted in debian-mentors these useful guidelines to > fight against those anoying messages. This works great for me, and > serve as a basis to fight against future similar viruses. > > Regards, Ismael > > ----- Forwarded message from Jarno Elonen <elonen@iki.fi> ----- > > From: Jarno Elonen <elonen@iki.fi> > Subject: Filter for W32/Swen@MM > To: debian-mentors@lists.debian.org > Date: Sat, 20 Sep 2003 16:38:37 +0300 > > Sven Luther wrote: > > > BTW, the attachement is of md5sum b09e26c292759d654633d3c8ed00d18d. > > > > Anyone know of an easy way to filter out emails where a given > > attachement has a particular md5sum ? > > I wrote a helpfull Python script this morning and have successfully filtered > about 60(!) virus mails with it today already. > > http://elonen.iki.fi/code/misc-notes/mpartinfo2hdr/ > > The program - when a message is piped though it - analyzes mail attachments > and puts the results in the header... > > X-Msg-Part-Info: attachment; size="106496"; > md5sum="b09e26c292759d654633d3c8ed00d18d"; > claimedmime="audio/x-wav"; name="gvzvfszn.exe"; > guessedmime="application/x-dosexec" > > ... so that one can write mail reader rules to filter messages with certain > attachments. I'm using Kmail myself, with the following rules: > > Add the attachment info to header: > > 1) 'To' doesn't equal 'MATCH_FOR_ALL' => > 'pipe through' '/home/jarno/bin/mpartinfo2hdr' > DON'T stop if this matches > > Remove certain virus mail: > > 2) 'any header' matches regexp > 'X-Msg-Part-Info:.*b09e26c292759d654633d3c8ed00d18d' > => move to trash > > Move probably virus mail: > > 3) 'any header' matches regexp > 'X-Msg-Part-Info:.*guessedmime="application.x-dosexec"' > OR > 'any header' matches regexp > 'X-Msg-Part-Info:.*name="[^"]*\.pif".*' > => move to folder 'virus' > > - Jarno > > > -- > To UNSUBSCRIBE, email to debian-mentors-request@lists.debian.org > with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org > > ----- End forwarded message ----- -- Joachim "nomeata" Breitner e-Mail: mail@joachim-breitner.de | Homepage: http://www.joachim-breitner.de JID: joachimbreitner@amessage.de | GPG-Keyid: 4743206C | ICQ#: 74513189 Geekcode: GCS/IT/S d-- s++:- a--- C++ UL+++ P+++ !E W+++ N-- !W O? M?>+ V? PS++ PE PGP++ t? 5? X- R+ tv- b++ DI+ D+ G e+>* h! z? Bitte senden Sie mir keine Word- oder PowerPoint-Anhänge. Siehe http://www.fsf.org/philosophy/no-word-attachments.de.html
Attachment:
signature.asc
Description: Dies ist ein digital signierter Nachrichtenteil