Re: [Exim] system_filter.exim

On Fri, 25 May 2001, Nigel Metheringham wrote:

>
> wash@??? said:
> > How does the filter compare to a commercial virus scanner?
>
> Its not a virus scanner. It catches a couple of easy virus header
> signatures and it looks for particular MIME types. It does *not* scan
> content, look in attachments or look at more than the first few
> kilobytes of the message. If you have a system vulnerable to viruses
> then you should think of additional protection.
>
> It does kill off most of the mail worms seen to date quite nicely.
>
>
> wash@??? said:
> > Why does it not insert the sender of the message, but rather just
> > gives <>???
>
> The probelmatic message was formatted as a bounce message - there is no
> sender information to add.


Yes, there is a certain well-known virus (Snow White and the 7 dwarves)
virus which propogates by sending messages from the null sender.

If you look at the original message, it should have the IP address that
it came from. It may be satisfying to you to find out what ISP's address
that is and forward it to them. Not that they are likely to do anything
about it. Once can protect one's own users from these viruses to a
limited extent, but its really quite futile to try and cure the entire
Internet of them.