I use the following, bear in mind there will never be genuine mail generated
by
a user called admin from any of our systems. I also have a completely
different ACL for systems we backup and smarthost for that works similarly
except it checks the sender_address_local_part and retrieves the domain part
from file listing domains we backup up for and smarthost for.
# check for W32.Mimail.A@mm
deny message = W32.Mimail.A@mm Worm attempt! Helo was: ($sender_helo_name)
IP was \
$sender_host_address
condition = ${if and {\
{eq{${lc:$sender_address}}{admin@$qualify_domain}}\
{!eq{$sender_host_address}{127.0.0.1}}\
}\
{yes}{no}}
> -----Original Message-----
> From: exim-users-admin@??? [mailto:exim-users-admin@exim.org]On
> Behalf Of ketvin
> Sent: Wednesday, August 13, 2003 2:51 AM
> To: exim-users@???
> Cc: Cheong Ket Vin
> Subject: [Exim] Block email address
>
>
> This is a multi-part message in MIME format.
> --
> --
> [ Picked text/plain from multipart/alternative ]
> Hi, I am having problem with the famous MiMail virus that send
> admin@??? emails. How do I block any email that is started
> with "admin" ? And is there anyway to protect Exim from that virus?
>
>
> Thank you.
>
>
> --
>
> --
>
>
> --
>
> ## List details at
> http://www.exim.org/mailman/listinfo/exim-users Exim details at
http://www.exim.org/ ##
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
