[Mimedefang] How to discard mail silently when it contains bad attachments
-ray
ray at ops.selu.edu
Tue Aug 26 01:28:00 EDT 2003
After watching logs for a while, we determined that all pif and scr
attachments lately are Sobig or some variant, so we decided to discard all
messages with a pif or scr attachment. I put this code in filter before
the virus scan. (virus scan still runs in filter_begin so i get clamav
logs of it)
# drop all pif messages -zrd 8/19/2003
$drop_exts = '(pif|scr)';
if (re_match($entity, $drop_exts)) {
md_graphdefang_log("SLU dropping file $fname from $RelayAddr");
return action_discard();
}
ray
On Mon, 25 Aug 2003 John.Mathews at events.wvu.edu wrote:
> Sobig.f is killing us here. The problem isn't finding and cleaning the
> virus, its
> sending out all those useless emails that have had the virus stripped out.
> Is there
> an easy way to have the filters just discard the mail if it is found to be
> infected?
>
> I'm getting 500+ per day in my own mailbox.
>
> tks,
> John
More information about the MIMEDefang
mailing list