[Mimedefang] Problems with zip file as attachement
Stefano McGhee
SMcGhee at ARCweb.com
Wed Jul 2 11:29:12 EDT 2003
Hello Ueli,
I and several other users on this list use code similar to the
following to do what you mention for a group of viruses, including SoBig.
In filter, in the Virus section, I have the following:
if ($category eq "virus") {
md_log('virus',$VirusName, $RelayAddr);
# This has been added to not bother notifying recipients
# of selected viruses that are from bogus addresses or have
# no real purpose.
if ($VirusName =~
/klez|bugbear|nimda|hybris|yaha|braid|sobig/i)
{
return action_discard();
} else {
return action_quarantine($entity, "A known virus was discovered
and d$
}
}
It may not be perfect or elegant, but it keeps the noise down. Does anyone
else get MD virus notifications forwarded to them as spam? ;-)
Cheers,
Stefano
> Iam running mimdefang 2.29 on a RH 8.0 System. The last
> couple days we were flooded with
> e-mails containing the Sobig-E virus in an attachment.
>
> mimedefang (sophos) detected the virus in a pif file, which
> was zipped in a *.zip file. The
> virus file was deleted but the zip file was sent to the
> enduser as *.zi file, which is totally
> rubbish.
> Actually I want to discard *EVERY* e-mail which contains a
> virus, no matter< if
> some other attachments are clean.
> Can you please tell me how to achieve this?
More information about the MIMEDefang
mailing list