[Exim] More on ILOVEYOU

Top Page
Delete this message
Reply to this message
Author: Nick O'Brien
Date:  
To: exim-users
New-Topics: Re: [Exim] More on --name of trojan deleted--
Subject: [Exim] More on ILOVEYOU
Is it pointed out at http://www.datafellows.fi/~descs/love.htm that the
ILOVEYOU virus will also email all RAS and Windows passwords to
mailme@??? the next time IE is started

I want to block all outgoing mail to this address - I assume that adding
something like this to my system filter should cover it:

if $h_to conatins mailme@??? or $repicients contains
mailme@???
then
fail text "you appear to have a virus on your PC (see \
http://www.fsecure.com/v-descs/love.htm).
endif

I am new to Exim filtering but it looks fine as far as I can see from the
documentation.

    Rgds.,


        Nick. 


========================================================================
"Animal? No, worse - human!", Manny - "Runaway Train"
Nick O'Brien                        Phone: +44 118 931 8432
Computer Officer                    Email: N.G.J.OBrien@???
Reading University, UK              Web: 
http://www.rdg.ac.uk/~vis98ngo/