[Mimedefang] Spam asssassin report
Shawn Button
sbutton at dtjboulder.com
Tue Aug 26 13:22:01 EDT 2003
Is there any way to have SA report the IP address of the mail server
that it tags as spam when attaching the SA .txt report? If so, anything
that mime defang strips and puts the notification at the bottom can this
put the IP address as well?
Thank you kindly,
Shawn
-----Original Message-----
From: mimedefang-admin at lists.roaringpenguin.com
[mailto:mimedefang-admin at lists.roaringpenguin.com] On Behalf Of -ray
Sent: Monday, August 25, 2003 11:28 PM
To: mimedefang at lists.roaringpenguin.com
Subject: Re: [Mimedefang] How to discard mail silently when it contains
bad attachments
After watching logs for a while, we determined that all pif and scr
attachments lately are Sobig or some variant, so we decided to discard
all
messages with a pif or scr attachment. I put this code in filter before
the virus scan. (virus scan still runs in filter_begin so i get clamav
logs of it)
# drop all pif and scr messages -shawn 8/26/2003
$drop_exts = '(pif|scr)';
if (re_match($entity, $drop_exts)) {
md_graphdefang_log("SLU dropping file $fname from $RelayAddr");
return action_discard();
}
ray
On Mon, 25 Aug 2003 John.Mathews at events.wvu.edu wrote:
> Sobig.f is killing us here. The problem isn't finding and cleaning
the
> virus, its
> sending out all those useless emails that have had the virus stripped
out.
> Is there
> an easy way to have the filters just discard the mail if it is found
to be
> infected?
>
> I'm getting 500+ per day in my own mailbox.
>
> tks,
> John
_______________________________________________
MIMEDefang mailing list
MIMEDefang at lists.roaringpenguin.com
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
More information about the MIMEDefang
mailing list