Re: [Exim] More on ILOVEYOU

Top Page
Delete this message
Reply to this message
Author: robert rotman
Date:  
To: lsu
CC: Exim
Subject: Re: [Exim] More on ILOVEYOU


hi all!

*** warning i never used filter ***


i have this in my filter but when i send the Virus with eg. mutt it sends
it at plaintext and the filter works.
when i attach the virus with pine it uudecodes the attachment and the
filter does not work any more, even there is a line like:

Content-Type: TEXT/PLAIN; charset=US-ASCII; \(one line)
name="LOVE-LETTER-FOR-YOU.TXT.vbs"


why doesnt the filter work?


robert



On Thu, 4 May 2000 lsu@??? wrote:

> Try
>
> if $message_body matches "name=.LOVE-LETTER-FOR-YOU\.TXT\.vbs."  or
>     $message_headers matches "name=.LOVE-LETTER-FOR-YOU\.TXT\.vbs."  then
>     logwrite "$tod_log virus: LOVE from $sender_address $message_id"
>     fail text "\n\nLOVE LETTER CANCELLED.\n\n"
>     finish
> endif

>
>
> >>
>
> >
> >On Thu, 4 May 2000 16:12:41 +0100 (GMT Daylight Time) Nick O'Brien
> ><n.g.j.obrien@???> wrote:
> >
> >> if $h_to conatins mailme@??? or $repicients contains 
> >>   mailme@???
> >> then
> >>    fail text "you appear to have a virus on your PC (see \
> >>    http://www.fsecure.com/v-descs/love.htm).
> >> endif

> >
> >Apologies my mail client decided to send off my mail before I had double
> >checked it :(
> >
> >I mean something like:
> >
> >if $h_to contains mailme@??? or $recipients contains
> > mailme@???
> >then
> > fail text "you appear to have a virus on your PC (see \
> > http://www.fsecure.com/v-descs/love.htm)."
> >endif
> >
> >    Nick

> >    
> >========================================================================
> >"Animal? No, worse - human!", Manny - "Runaway Train"
> >Nick O'Brien                        Phone: +44 118 931 8432
> >Computer Officer                    Email: N.G.J.OBrien@???
> >Reading University, UK              Web: http://www.rdg.ac.uk/~vis98ngo/

> >
> >
> >
> >--
> >## List details at http://www.exim.org/mailman/listinfo/exim-users Exim details at http://www.exim.org/ ##
> >
>
>
> --
> ## List details at http://www.exim.org/mailman/listinfo/exim-users Exim details at http://www.exim.org/ ##
>


---
di. robert rotman                                   inode.graz
phone -> ++43-(0)316 813141       ++43-(0)316 818600/15 <- fax
rotman@???                      http://www.graz.inode.at/
--
this letter was written on recycled bytes used by deleted mail.