Right now I would check for the content type: since it seems to be hardcoded, and very very very
unique, to this
Jason
On 21 Sep 2001 at 9:37, Margrit.Lottmann@??? wrote:
Date sent: Fri, 21 Sep 2001 09:37:28 +0200 (DFT)
From: <Margrit.Lottmann@???>
To: exim-users@???
Subject: [Exim] Nimda++...Except???
> Which ideas I had seen in this list to find Nimda Virus in
> this list:
>
> 1. search for ...=readme.exe ... in the bodies...
> 2. search for "exe"'s
> 3. search for audio/wav-headers
> 4. using a email virus checker like exiscan in condition with
> sophos(sweep)
>
>
> We are using "1." , but I think I cannot receive now messages
> from (for example) our security organisations or other warnings,
> which describe this virus with a text, that contains the
> given filter condition.
>
> Is it possible to except addresses from filter checking in exim ???
>
>
>
> MfG Margrit Lottmann
>
>
> +-----------------------------------------------------------------------+ |
> phone : +49 391 67 18572 | |
+49
> 391 67 12819 | | Margrit Lottmann fax : +49 391
> 67 11134 | | | |
> Otto-von-Guericke-Universitaet Magdeburg | |
> Universitaetsrechenzentrum, URZ-N | |
> Universitaetsplatz 2 | | D-39106
> Magdeburg, Germany | |
> | | Margrit.Lottmann@???
> |
> +-----------------------------------------------------------------------+
>
>
>
---
Jason Robertson
Network Analyst
jason@???
http://www.astroadvice.com
