Re: [Exim] Generic VBS script detection

Top Page
Delete this message
Reply to this message
Author: Alan Thew
Date:  
To: Julian King
CC: exim-users
Subject: Re: [Exim] Generic VBS script detection
One of the virus sites said that only Outlook 98 and 2000 were executing
the `mail everyone' stuff. OE can auto run though...

-- 
Alan Thew                                       alan.thew@???
Computing Services,University of Liverpool      Fax: +44 151 794-4442


On Thu, 4 May 2000 19:19 , Julian King <jpk28@???> said:

>> I am not a filter expert :-(, and have not tested this, but how about
>> something like this as a starting point:-
>>
>>   if ($message_body matches "^\\s+name=[A-Za-z0-9_-.]+.[vV][bB][sS]" or
>>       $message_body matches "^begin \\d\\d\\d .+\\.[vV][bB][sS]")
>>     ... then/action/endif

>
>One additional test that we have been pondering in this office was
>to test for a suspect mail agent, say M$ Outlook, although others like
>Eudora should not be forgotten. Viruses are only likely to be coming
>from a windows box, basically.
>Half the office just wants to throw away all mail from M$ boxes, but
>on sober reflection that might be politically untenable ;-)
>
>
>>     Nigel.

>
>Julian
>--
>Julian King
>Computer Officer, University of Cambridge, Unix Support
>
>--
>## List details at http://www.exim.org/mailman/listinfo/exim-users Exim details at http://www.exim.org/ ##
>