[Mimedefang] How to discard mail silently when it contains bad attachments

-ray ray at ops.selu.edu
Tue Aug 26 01:28:00 EDT 2003


After watching logs for a while, we determined that all pif and scr 
attachments lately are Sobig or some variant, so we decided to discard all 
messages with a pif or scr attachment.  I put this code in filter before 
the virus scan. (virus scan still runs in filter_begin so i get clamav 
logs of it)

     # drop all pif messages -zrd 8/19/2003
    $drop_exts = '(pif|scr)';
     if (re_match($entity, $drop_exts)) {
         md_graphdefang_log("SLU dropping file $fname from $RelayAddr");
           return action_discard();
    }

ray


On Mon, 25 Aug 2003 John.Mathews at events.wvu.edu wrote:

> Sobig.f is killing us here.  The problem isn't finding and cleaning the
> virus, its
> sending out all those useless emails that have had the virus stripped out.
> Is there
> an easy way to have the filters just discard the mail if it is found to be
> infected?
> 
> I'm getting 500+ per day in my own mailbox.
> 
> tks,
> John




More information about the MIMEDefang mailing list