On Thu, Aug 26, 2004 at 03:33:36PM +0200, R.B. (Rick) wrote:
> my problem now is block those bounce messages coming from mailing system
> that catch emails with virus that have forged sender... in this way my
> users get a virus notify and every time call me worried about that...arg
> what do you think abount create an ACL to block msgs wit the sender <> and
> that contains the word virus in subject or in the body? Should work?
> Any better solution?
This is based on a series of tests posted by Paul Vixie to the NANOG
mailing list, modified for exim and posted to this list by Richard Welty.
Steve
acl_check_data:
# From my own SPAM bin - (SAR) 24 August 2004
deny condition = ${if match{$header_subject:}{Symantec Email Proxy Deleted Me
ssage}{yes}{no}}
message = Don't send pointless AV notifications, please
# Posted to exim-users list on 31 Jan 2004 by Richard Welty
# (based on NANOG posting by Paul Vixie) - (SAR) 31 January 2004
deny condition = ${if match{$header_subject:}{Anti-Virus Notification}{yes}{no}}
message = Don't send pointless AV notifications, please
deny condition = ${if match{$header_subject:}{BANNED FILENAME}{yes}{no}}
message = Don't send pointless AV notifications, please
deny condition = ${if match{$header_subject:}{File blocked - ScanMail for Lotus}{yes}{no}}
message = Don't send pointless AV notifications, please
deny condition = ${if match{$header_subject:}{InterScan NT Alert}{yes}{no}}
message = Don't send pointless AV notifications, please
deny condition = ${if match{$header_subject:}{Message deleted}{yes}{no}}
message = Don't send pointless AV notifications, please
deny condition = ${if match{$header_subject:}{NAV detected a virus}{yes}{no}}
message = Don't send pointless AV notifications, please
deny condition = ${if match{$header_subject:}{Norton AntiVirus detected}{yes}{no}}
message = Don't send pointless AV notifications, please
deny condition = ${if match{$header_subject:}{RAV AntiVirus scan}{yes}{no}}
message = Don't send pointless AV notifications, please
deny condition = ${if match{$header_subject:}{Symantec AntiVirus}{yes}{no}}
message = Don't send pointless AV notifications, please
deny condition = ${if match{$header_subject:}{VIRUS .* IN MAIL FROM YOU/}{yes}{no}}
message = Don't send pointless AV notifications, please
deny condition = ${if match{$header_subject:}{VIRUS IN YOUR MAIL}{yes}{no}}
message = Don't send pointless AV notifications, please
deny condition = ${if match{$header_subject:}{Virus Detected by Network Assoc}{yes}{no}}
message = Don't send pointless AV notifications, please
deny condition = ${if match{$header_subject:}{[MailServer Notification]To Sender virus found and action taken}{yes}{no}}
message = Don't send pointless AV notifications, please
# accept otherwise
accept
----------------------------------------------------------------------
Steven A. Reisman <sar@???> P.O. Box 409
Press Enter LLP 421 N 2nd Street
715-426-2100 or 651-436-5254 River Falls, WI 54022
----------------------------------------------------------------------
