--
On Fri, May 10, 2002 at 01:05:23PM +1000, Brown wrote:
| This is a multi-part message in MIME format.
| --
| [ Picked text/plain from multipart/alternative ]
| Hi all,
|
| i'm having a bit of trouble filtering emails infected by the klez
| virus. I'm currently using system_filter.exim, which works well, but
| klez seems to be able to get through. Does anyone have any
| suggestions?
if
"$message_body $message_body_end"
matches "Content-.*audio/x-wav.*\.(?:pif|exe)"
or
"$message_body $message_body_end"
matches "Content-.*audio/x-mid.*\.(?:scr|exe)"
or
"$message_body $message_body_end"
matches "<iframe.*</iframe>"
then
fail "<<klez (sender: $sender_address) (From: $h_From:)>> \
This message has been rejected because the body contains \n\
text that appears to be MIME Content-Type: headers used by KLEZ.\n\
If you intended to send the data then please gzip it and resend it."
seen finish
endif
-D
--
Consider what God has done:
Who can straighten what He has made crooked?
Ecclesiastes 7:13
GnuPG key :
http://dman.ddts.net/~dman/public_key.gpg
--
[ Content of type application/pgp-signature deleted ]
--