Date: Thu, 4 May 2000 19:55:51 -0700 From: "Charles Mauch" <cpm@yoonax.net> To: <freebsd-questions@freebsd.org> Subject: Fix for Love Virii (sendmail) Message-ID: <NDBBJECCALJAGLIEMPKIGEAPCOAA.cpm@yoonax.net>
next in thread | raw e-mail | index | archive | help
We were nailed at work with the ILOVEYOU virii. This was my second round with an outbreak
like this and I'd allready applied my own hacked up fix. If it comes in handy, let me
know. It does cause a little extra load on sendmail, but compared to the load we would
have experienced if I'd let it run rampant for the next hour it's nothing ;) Let me know
if you find it handy.
Apply this to your original .mc and compile it into your sendmail.cf
LOCAL_RULESETS
# Virus checking routine.
HSubject: $>Check_Subject
D{MPatLove}ILOVEYOU
D{MMsgLove}This message may contain the the Love Letter virus.
D{MPatPark}C:\\CoolProgs\\Pretty Park.exe
D{MMsgPark}This message may contain the Pretty Park virus.
SCheck_Subject
R${MPatLove} $* $#error $: 553 ${MMsgLove}
RRe: ${MPatLove} $* $#error $: 553 ${MMsgLove}
R${MPatPark} $* $#error $: 553 ${MMsgPark}
RRe: ${MPatPark} $* $#error $: 553 ${MMsgPark}
Please note that between $* and $#error there *MUST* be a tab, no spaces.
Charles Mauch
---
Email: cpm@yoonax.net / Finger for PGP Public key
PGP Fingerprint: B02C B98B 02A5 3D76 8C74 B24F 9279 337C
This email was generated by a Congregation of Worried Midgets
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?NDBBJECCALJAGLIEMPKIGEAPCOAA.cpm>