[Mimedefang] New .zip virus?

[Joseph Brennan]

This is based on reports at Symantec and another site.


in sub filter ($$$$)

    # Novarg virus
    if ($fname =~ /(document|readme|doc|text|file|data|test|message|body)/i 
&&
        $ext =~ /(bat|cmd|exe|pif|scr|zip)/ ) {
        md_graphdefang_log('virus',"Novarg-Midoom $fname $type");
        return action_bounce("Bad attachment");
    }


This getting about 120 per minute here.

Make the md_graphdefang_log data and action_bounce text be the way you like 
it.

Joseph Brennan
Columbia University, Academic Technologies Group