procmail
[Top] [All Lists]

Re: badtrans again

2001-12-08 10:05:29
yesterday it was badtrans, today its gooner and tommorow its something
new. There is no sense in dealing with special viri.

After my systems wasnt infected by viri for the last two years, cause
I disabled vbs on all clients I had nightmare the last two weeks
because of aliz-worm, gooner, magistr and badtrans.  In each network
this exe's were opened by users at least 3 times a day, even after I
sent broadcast-faxes and more. They will never learn.

Finally I installed sanitizer on the gate and block all exe, pif, scr
...  Additionally I promised my users to block zip's too if they open
exe's sent in zip-files. By now sanitzier blocks about 30 mails per
day ...



:)

peter




On Sat, Dec 08, 2001 at 02:14:25PM -0000, Edward Bishop wrote:
I joined the list a couple of weeks ago having been pointed here for help
with badtrans etc. Lurking has been very interesting but being a
procmail/regexp newbie it's been a bit tricky to follow. I am still getting
these viruses so would it be in order to ask for summary/conclusions on a
couple of points?

1 What was the final verdict on the idea someone mooted of blocking
everything where the sender's address began with underscore? That would have
worked for me.

2 What recipe if any was arrived at for this (or a better solution) and
where in the appropriate file (procmailrc I presume) is it to be put?

Many thanks

--
Eddie



_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail


-- 
mag. peter pilsl

phone: +43 676 3574035
fax  : +43 676 3546512
email: pilsl(_at_)goldfisch(_dot_)at
sms  : pilsl(_at_)max(_dot_)mail(_dot_)at

pgp-key available
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>