Re: [Exim] Blocking sobig.f

Top Page
Delete this message
Reply to this message
Author: Jawaid.Bazyar
Date:  
To: exim-users
Subject: Re: [Exim] Blocking sobig.f
I tried this filter - however I couldn't get it to work.

I do have the suggested subject filter working.

Is there some trick to get the $message_body filter working? How do I tell
exim to look more than 500 characters into the body?

Thanks.



>
> So is this a sobig specific string for infected files?
>
> On Wednesday, August 20, 2003, at 03:48 AM, Alun wrote:
>
> > if $message_body contains
> > "AAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZS
> > BydW4gaW4g"
> > then
> >     logfile "/tmp/virus.log"
> >     logwrite "$tod_log blocked to $recipients from $sender_host_address"
> >     seen finish
> > endif

>
>
> --
>
> ## List details at http://www.exim.org/mailman/listinfo/exim-users Exim details at http://www.exim.org/ ##
>
>


--
 Jawaid Bazyar                 |   Affordable WWW & Internet Solutions
 foreThought.net               |   for Small Business
 jawaid.bazyar@??? |   910 16th Street, #1220  (303) 228-0070
 --The Future is Now!--        |   Denver, CO 80202        (303) 228-0077 fax