procmail
[Top] [All Lists]

Re: Delete a specific EXE

2001-12-04 05:37:25
I too have had the same experience.  I have an ISP in a very rural area
and understand what you're going through.  I have been subscribed to this
list for over a year.  I even made a post like you a few months ago.  I got
shot down too.  I was told that this isn't a list for viruses and procmail
isn't for stopping viruses.  I have tried the canned programs that have been
suggested on this list.  Most of these are kludges that require a dozen 
obscure perl mods that won't install, compile or do exactly what is needed.

What I did find was Batemail.  It removes all executable MIME attachments.

http://sourceforge.net/projects/batemail/

Yes it's perl.  But it does work.  It removes the executable and adds a
note that the virus has been removed and what they can do to get the
virus.exe from the user if they want it.

I have told all my customers that we will not allow executables attachments
in email.  I think this is the only solution.  I've received a lot of positive
feedback from my customers for my forward thinking on this.  With polymorphic
viruses like Magistr, PROCMAIL WILL NOT WORK!  The coming virus outbreaks 
will be much worse than what we've seen to date as the virus writers fine
tune their code.  We've seen this in Code Red, Magistr and now Btrans.b.

So please leave the "gods" of procmail alone.  As we've all seen, they get
grumpy when prodded. 

:0)


-greg

_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>