On Tue, Jul 24, 2001 at 10:58:10AM -0400, [EMAIL PROTECTED] wrote:
>
> Can anyone help me figure out a way to handle this recent virus?
>
> It typically tags email in body:
> '...in order to have your advice...'
>
> and sends random attachments .2 to 2Mb in size.
>
> We're getting a lot of these already, and I'm worried
> that a flood will jam us up, amounting to a DOS. At the very
> least, this is going to cost us a lot of bandwidth $$$.
>
> Seems to me the only way to stop it is to scan the body before
> the mail is accepted. Yeech. And as soon as we get variations on
> '...in order to have your advice...' it will be just about
> indistinguishable from normal email with attachments.
If it helps, I process the header with
^Content-Type:.*_Outlook_Express_message_boundary virus W32/Sircam-A-Virus
Now just find a place to put that (my implementation is not site-portable).
And no, it won't block real Outlook Express mails.
Jost
--
| [EMAIL PROTECTED] Please help stamp out spam! |
| Postmaster, JAPH, resident answer machine am RZ der RUB |
| Pluralitas non est ponenda sine necessitate |
| William of Ockham (1285-1347/49) |
