* R A Lichtensteiger <rali(_at_)tifosi(_dot_)com> [2004-02-04 14:13]:
On the gripping hand, the characteristics that make MyDoom recognisable
are in the body of the message anyway, so there isn't much you can do
ahead of the DATA part of the smtp transaction anyway :( At best, you
can refuse the message before completing the transaction.
Yes i have been thinking that, but was still hoping maybe for something.
If you were trying to reduce the load on the internal servers, then
you could slot procmail into the flow without too many changes, but
your description indicates the problem is on the external server. Is
the machine in fact bogging down? Or have you just hit the thresholds
you set in sendmail.cf?
Just the thresholds in the sendmail.cf.
It sounds like you are already using sendmail milters to get your
incoming messages to the virus checker. You might consider using one
of the regular expression milters (perhaps the PERL milter) to kill
these things off.
No milters, but that is an idea.
Thank you.
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail