On 09/19/01 07:15 PM, Professional Software Engineering sat at the `puter and
typed:
At 20:40 2001-09-19 -0500, Kevin wrote:
How do I test my Nimda filter.. Can I create or download a file
or what ??
Thank You !
First, I'd write a message in my richtext mail app and choose a nonstandard
font and choose a bight blue colour for the text, then I'd mail it to the
address where the filter is.
It is important to note that the Procmail list is not a virus archive (nor
is it a spam archive). Perhaps you can find a copy of the virus in some of
the virus discussion groups on usenet.
If you don't already HAVE the virus in the form of an email, it'll be
difficult to TEST your filter until you do get a copy (since until then,
you're relying on second hand descriptions of how the message is
propagated). However, when you do get a copy, you'll know if your filter
is catching it properly, or if it is missing it. If your filter is storing
a copy (rather than throwing it out), you'll have a copy you can throw at a
standalone copy of the filter to your heart's content in order to fine-tune
the thing.
If it is any consolation, while my various webservers have been absolutely
HAMMERED by the web-based form, I've yet to see a single email come through.
HAMMERED is a good way to put it. I just deleted the first 12,000
email 404 notifications from this thing. Total, in about 36 hours, I
got something like 12,350 hits. Not that big a deal, since I'm not
running any commercial stuff, but it gives me an idea what those
systems are seeing that have cross connects, multiple T1s, OC3 feeds,
etc.. They are within a couple hops of many more potentially infected
systems.
When the CodeRed worm showed up, someone pointed me to a mod_perl
handler for the nasty bugger (Apache::CodeRed on CPAN). Now I just
wish there were something similar for this one.
Lou
--
Louis LeBlanc leblanc(_at_)acadia(_dot_)ne(_dot_)mediaone(_dot_)net
Fully Funded Hobbyist, KeySlapper Extrordinaire :)
http://acadia.ne.mediaone.net Ô¿Ô¬
manic-depressive, adj.:
Easy glum, easy glow.
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail