[Mimedefang] How to discard mail silently when it contains bad attachments

Joseph Brennan brennan at columbia.edu
Fri Sep 12 15:24:01 EDT 2003


> I hope the code in
> http://lists.roaringpenguin.com/pipermail/mimedefang/2003-September/00776
> 8.html works correctly.  Any comments ?

Well, it matches on the extension only, not the whole filename...

Here's what we've seen lately as examples (3 days, sort -u).  Some
should look familiar.  Some others seem to be built from real
filenames on the infected PC.

"45443.pif
"screensaver.scr
....scr
0,15601,0~3-0~0~0,00[1].scr
000000.pif
11ta[1].scr
14_2[1].scr
167c02.pdf.pif
19 August Report to RCPOS.doc.pif
1_multipart_xF8FF_2_Ethics_Presentation_week_4.doc.pif
2003.scr
250827_n_may29_1[1].scr
28.8.pif
73103 email to Pioneer.doc.scr
87103ee1a553[1].scr
95 host.scr
ADSAdClient31[20].pif
ATT00075.txt.scr
AddressBook1.xls.scr
Addressees sent Address.xls.scr
Annual spring 2001 around the way girl.mp3.scr
Article for Health and Canadian Society.doc.scr
BGCOLOR.pif
BLANK.pif
BORDER.scr
BOROCV.#3(pr.MW 4.0).wps.scr
Barock Ohrenlehnenstuhl.pif
Betsy ph.xls.scr
Book2.xls.scr
Bryan0.scr
Buddies.blt.scr
CAUVO1QV.pif
CF_ImageMate.jpg.pif
CLUSTER V.doc.scr
COLOR.scr
Cf.pif
DES.scr
De.scr
Dnwuw.pif
Done..pif
Dwxzt.pif
FW_ Life in Heaven.email.pif
Fg.scr
Final.scr
Geldkarten .doc.pif
Ghc.pif
Ghmua.pif
Gongage.wps.pif
HEIGHT.scr
HREF.scr
Hasbro..scr
He.scr
Hfvh.scr
Hgy.scr
It is.pif
Jue.pif
Jul 11.scr
Latin C . W..doc.scr
Lgvb.pif
LostPassword[1].pif
MOUSE8.pif
MSNPYMNT.pif
Miz.scr
My Money.mny.scr
NCS Notes from the Class of 1956.doc.scr
NOWRAP.scr
NSOLEEBYUKQN[1].pif
New Text Document.txt.scr
Oct.pif
PM,.scr
Pacific.pif
Player.pif
Rj.scr
Rsenw.scr
Runner.scr
Ryns.pif
Râs2001Nf[^.xls.scr
SETUPLOG.pif
SETUPXLG.pif
SQLOLEDB.pif
SRC.pif
Service.pif
Sex in Office.rm.scr
Shortcut to Northwind.lnk.pif
Stein Mart.doc.scr
Stephie.rtf.pif
Sub.pif
This is.scr
UNE NOUVELLE VIE DU LIVRE edite.doc.pif
UNE NOUVELLE VIE DU LIVRE edite.doc.scr
Valentines_Day.scr
William Cobbett.mpg 
.scr
XHTML.scr
YupiMSN - Club del amor-Hector A._archivos.scr
Zgdd.scr
addresses.bmp.pif
album 1 of house.albm.scr
align.scr
alt.pif
alt.scr
any.pif
anyuser at www.dgm2[3].scr
aoladp[19].scr
apple comp.doc.pif
application.pif
arama.scr
banner[1].pif
bgcolor.pif
bigger.pif
bill or.pif
border.pif
cartpic.wps.scr
charset.pif
chords.exe.scr
class.scr
colleen  dougherty at 4rock.4anything[1].pif
color.pif
color.scr
default.scr
desktop.scr
details.pif
document_9446.pif
document_all.pif
end.pif
end.scr
exe.1.doc.pif
exit[2].scr
fee Schwab Beheer.doc.scr
fee Schwab Beheer.gif.pif
fontsize.scr
friendsgreetings.scr
fun.pif
getimages[4].scr
guneri_civaoglu.wav.scr
gurli crawford at bouncer[6].scr
height.pif
height.scr
here to.pif
home[1].scr
href.pif
href.scr
html_image_src[3].scr
image final l use.bmp.scr
index_09-index_13_over[1].pif
jacob.htm.scr
jacob.mpg 
.pif
jacob.mpg.scr
jacob.xls 
.pif
kaschei at valueclick[2].scr
kaschei at www.maxpages[1].pif
kaschei at www.webverzeichnis.immopage[2].txt.pif
locmenu.scr
love.scr
lovefinder.scr
loverscreensaver.scr
loveshore.scr
main_02[1].pif
maininfo[1].scr
makes.pif
mehr.pif
midgets.scr
milf4[1].pif
movie0045.pif
name.pif
name.scr
new_pa24.gif.scr
news.scr
nod.scr
of it).pif
onClick.scr
onblur.scr
onload.pif
out.scr
purchased[1].pif
screensaver.scr
seltime[1].scr
setup.exe.pif
shakinglove.scr
shelly.doc.pif
shirley at 71469122[2].pif
spectinpregatirept.stagiunea03-04.doc.scr
src.pif
src.scr
subsites[1].scr
target.scr
thank_you.pif
tm_movieclips_329[1].scr
tour[1].scr
track[1].scr
true.scr
valign.pif
value.scr
werfriends.scr
wicked_scr.scr
width.scr
your.pif
your_details.pif
your_document.pif
zeit .scr
zut.doc.scr
~$m Ream Letter.doc.scr
~WRL0132.tmp.scr
Êîïèÿ Ï?îòîêîë.doc.scr
Îòâå÷à? íà Âàøå ïèñüìî îò 4 è?íÿ 2003.doc.pif




Joseph Brennan         Columbia University in the City of New York
Academic Technologies Group                   brennan at columbia.edu








More information about the MIMEDefang mailing list