One thing I noticed about the filter is that it does not stop attachments
whose names are both unquoted and have a space in the filename. I noticed
that a variant of the original loveletter (fwd: joke) does meet these
conditions. I'm not familiar enough with rexexp to fix this quickly, any
thoughts on how to do this?
Kevin Brady
Network Administrator
Creative Solutions
kbrady@???
-----Original Message-----
From: Nigel Metheringham [
mailto:Nigel.Metheringham@VData.co.uk]
Sent: Friday, May 19, 2000 6:01 AM
To: exim-users@???
Subject: [Exim] More viral fun and games
At the risk of sounding like an anti-virus product manufacturer
attempting to hawk his wares....
There appears to be a new and more destructive LOVELETTER variant
around. It is polymorphic and the attachment name changes as does the
subject etc. From my reading of the information on it the generic
executable attachment killer should deal with it - see
ftp://ftp.exim.org/pub/filter/system_filter.exim
Further reading:-
http://www.fsecure.com/v-descs/newlove.htm
http://www.antivirus.com/pc-cillin/vinfo/virusencyclo/default5.asp?VNa
me=VBS_NEWLOVE.A
Nigel.
--
[ - Opinions expressed are personal and may not be shared by VData - ]
[ Nigel Metheringham Nigel.Metheringham@??? ]
[ Phone: +44 1423 850000 Fax +44 1423 858866 ]
--
## List details at
http://www.exim.org/mailman/listinfo/exim-users Exim
details at
http://www.exim.org/ ##
