From owner-freebsd-questions Tue Nov 27 12:13: 4 2001 Delivered-To: freebsd-questions@freebsd.org Received: from q.closedsrc.org (ip233.gte15.rb1.bel.nwlink.com [209.20.244.233]) by hub.freebsd.org (Postfix) with ESMTP id 7403337B419 for ; Tue, 27 Nov 2001 12:11:52 -0800 (PST) Received: by q.closedsrc.org (Postfix, from userid 1002) id 7611313607; Tue, 27 Nov 2001 12:11:51 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by q.closedsrc.org (Postfix) with ESMTP id 652B9BA1B; Tue, 27 Nov 2001 12:11:51 -0800 (PST) Date: Tue, 27 Nov 2001 12:11:51 -0800 (PST) From: Linh Pham To: Mathieu Arnold Cc: setantae , FreeBSD questions Subject: Re: The Stupid Virus going arround. In-Reply-To: <3C03AC15.1113F8AF@club-internet.fr> Message-ID: <20011127121006.S59319-100000@q.closedsrc.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On 2001-11-27, Mathieu Arnold scribbled: # not a procmail rule, but a postfix:body_check : # /^\s+name="?.*\.(doc|zip|exe|xls|jpg|gif|mp3)\.(scr|pif|bat|com|exe|lnk)"?/ REJECT A more inclusive rule for body_check would be: /^Content-(Disposition|Type): application\/mixed/ REJECT /^Content-(Disposition|Type):.*name="?.*\.(bat|com|pif|vb|exe|lnk|scr|reg|chm|wsh|js|inf|shs|job|ini|shb|scp|scf|wsc|sct|dll)/ REJECT This should cover almost any kind of worm/trojan/virus that might come through. It is quite restrictive, you it can easily be modified by removing the extension and the trailing pipe in the second line. -- Linh Pham [lplist@closedsrc.org] # Every solution breeds new problems To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message