[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: [OT] Virus W32/Swen@MM spreading...



Sven Luther wrote:
BTW, the attachement is of md5sum b09e26c292759d654633d3c8ed00d18d.
Anyone know of an easy way to filter out emails where a given
attachement has a particular md5sum ? My tries with uudeview, grep, sed
and med5sum where not that much of a success.

I personnaly use the sanitizer from John D. Hardin, which also checks attachemts among other useful things
http://www.impsec.org/email-tools/procmail-security.html

You could use the virus script checker, and a check_for_virus script external wrapper like:

if test -n "$1"; then
if test -f "$1"; then

if test "`/usr/bin/md5sum $1 | /usr/bin/cut -f1 -d' '`" = "b09e26c292759d654633d3c8ed00d18d"; then
echo "VIRUS : Swen"
else
echo "CLEAN"
fi
exit 0

fi
fi

echo "ERROR"
exit 0

I personnally use f-prot (not "free" but royalties-free, www.f-prot.com) to clean the (large) amount of spam I receive


---
Xavier Roche
roche at httrack do com



Reply to: