From owner-freebsd-isp Fri May 5 8:41:13 2000 Delivered-To: freebsd-isp@freebsd.org Received: from defiant.quansoo.com (defiant.quansoo.com [63.66.225.90]) by hub.freebsd.org (Postfix) with ESMTP id C71E637BB22 for ; Fri, 5 May 2000 08:41:07 -0700 (PDT) (envelope-from cgriffiths@quansoo.com) Received: from localhost (cgriffiths@localhost) by defiant.quansoo.com (8.9.3/8.9.3) with ESMTP id LAA02110 for ; Fri, 5 May 2000 11:41:12 -0400 (EDT) (envelope-from cgriffiths@quansoo.com) X-Authentication-Warning: defiant.quansoo.com: cgriffiths owned process doing -bs Date: Fri, 5 May 2000 11:41:12 -0400 (EDT) From: "Christopher T. Griffiths" To: freebsd-isp@freebsd.org Subject: Sendmail rules to eliminate .vbs files Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-isp@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org I have seen some variations to stoping the email viruses by screening the Subject line for example in my sendmail.cf I have the following: HSubject: $>Check_Subject D{MPat}ILOVEYOU D{MMsg}This message may contain the ILOVEYOU virus. SCheck_Subject R${MPat} $* $#error $: 553 ${MMsg} RRe: ${MPat} $* $#error $: 553 ${MMsg} I am wondering if there is a way to screen for the .vbs files attached instead. Thus blocking emails with attached .vbs files in the same way we are blocking the subject line. I have done some sendmail hacking before but I am not sure if this would be possible via a ruleset. Any suggestions or comments? Chris --- Christopher T. Griffiths Engineering Department Quansoo Group Inc. cgriffiths@quansoo.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message