Re: [Exim] bugbear worm]

Robert Stanford wrote:
> On Tue, 2002-10-08 at 16:49, Todd Lattimer wrote:
>
>>Hi all,
>>
>>I was wondering if anyone has setup a filter to catch the bugbear worm.
>>I've tried installing the one below but it doesn't appear to be working.
>>If anyone has had any luck blocking this worm i'd be keen to know what you
>>did that got it stopped.
>>
>
>
> This is a bit severe however it works. I added the following to the
> generic executable filter mentioned on exim.org index page.
>
> The virus seems to send out in 2 forms, one as a regular attachment and
> another as an embeded midi file. The later is the type that gets past
> the regular filter.
>
> Several days later and on several boxes we seem to have had no breaches
> yet. /me keeps fingers crossed


IMHO one should use a virus-scanner to catch viruses, a systemfilter is
not the right thing, especially not if it's such easy builded as yours.

It should be a little bit more specific and at least filter for
Content-type: audio/x-FILTERPROOF ;)-midi;

with your current filter you shouldn't even receive your own mail you
sent to the exim-list ;)


ciao