[Mimedefang] How to stop Neroma / 911 virus?
Mike Heller
mike at dsny.com
Thu Sep 4 14:53:01 EDT 2003
Hello, There is a new virus going around, details are here:
http://sarc.com/avcenter/venc/data/w32.neroma@mm.html
*Subject*: It's Near 911!
*Message*: ice butt baby!
*Attachment*: 911.jpg
I have tried to setup a couple of filters in "filter":
if ($fname =~ /911/i) {
syslog('warning', "attachment $fname of type $ext discarded
W32.Neroma virus.");
return action_discard();
}
if ($Subject =~ /911!/i) {
syslog('warning', "attachment $fname of type $ext discarded
W32.Neroma virus.");
return action_discard();
}
I tried some other combinations and sent some test messages through and
they seem to make if fine. Can anyone help me out and create a filter
for this virus?
Thanks,
Mike
More information about the MIMEDefang
mailing list