> Can anyone help?
> This Exim4 ACL doesn't seem to be working - everything gets rejected.
> I'm sure I'm doing something obviously wrong, but I haven't written
> ACL's before..
>
> check_sobig:
Exactly how are you calling check_sobig? My experience with it, this should
suffice:
deny message = Virus infected message (or spam)
condition = ${if match{$h_date:}{--}{yes}{no}}
every instance of sobig I've seen so far puts a - before the timezone
offset. You might want to check for -[-+] instead of -- ...
Wait, I just saw one that has a proper date header.
Maybe: condition = ${if def:h_X-MailScanner {yes}{no}}
That's not tested but should work.
I see: X-MailScanner: Found to be clean
in every message this virus sends.
> deny message = Virus infected message
> condition = ${if match {$h_subject:}{Re: My Details} {yes}{no}}
> deny message = Virus infected message
> condition = ${if match {$h_subject:}{Re: Details} {yes}{no}}
> deny message = Virus infected message
> condition = ${if match {$h_subject:}{Your Details} {yes}{no}}
> deny message = Virus infected message
> condition = ${if match {$h_subject:}{Re: That movie} {yes}{no}}
> deny message = Virus infected message
> condition = ${if match {$h_subject:}{Re: Wicked screensaver} {yes}{no}}
> deny message = Virus infected message
> condition = ${if match {$h_subject:}{Re: Details} {yes}{no}}
> deny message = Virus infected message
> condition = ${if match {$h_subject:}{Re: Thank you!} {yes}{no}}
> deny message = Virus infected message
> condition = ${if match {$h_subject:}{Thank you!} {yes}{no}}
> deny message = Virus infected message
> condition = ${if match {$h_subject:}{Re: Approved} {yes}{no}}
> accept
>
>
> --
> Avleen Vig
> Systems Administrator
> Personal: www.silverwraith.com
> EFnet: irc.mindspring.com (Earthlink user access only)
>
> --
>
> ## List details at http://www.exim.org/mailman/listinfo/exim-users Exim details at http://www.exim.org/ ##
>
--
Lab tests show that use of micro$oft causes cancer in lab animals
