Re: [Exim] More windows viruses

Top Page
Delete this message
Reply to this message
Author: Tony Finch
Date:  
To: Ian A B Eiloart
CC: Exim users list
Subject: Re: [Exim] More windows viruses
On Fri, 19 Mar 2004, Ian A B Eiloart wrote:

> >> >   deny    condition = ${if match{$h_X-Priority:}{3}{yes}{no}}
> >> >       condition = ${if match{$message_body}{<OBJECT
> >> >       STYLE=\"display:none\" *\
> >> >               DATA=\"http:\/\/[0-9\.]+:81\/[0-9]+\.php\">} {yes} {no}}


Note that there can be one or two spaces before both STYLE and DATA.

> The more imoportant point, though, is that the bagle virus may use other
> ports. Another post suggested that sometimes no port is specified.


All the versions I have seen specify :81.

--
Tony Finch <dot@???> http://dotat.at/