Rejecting SOBIG & More Virus Emails with Sendmail
Date: Tuesday, August 19 @ 14:53:53 CEST
Topic: Security


Hi folks, I wrote a nice sendmail filter to block email messages based on the subject header. So instead of my blocking the email addresses I mentioned earlier due to Sobig, I now changed it to this instead. I tested it using Sendmail interactively as well as sending email to local accounts from Yahoo.

##

## Common Virus Subjects
##
HSubject: $>Check_Subject
D{VMsg}" - [EXT_VMSG] This message may contain a virus - see http://computercops.biz/anti-spam.html"

SCheck_Subject
R$* ILOVEYOU $* $#error $: 550 5.7.0 ${VMsg}
RA funny game $* $#error $: 550 5.7.0 ${VMsg}
RA special nice game $* $#error $: 550 5.7.0 ${VMsg}
RRe : some questions $* $#error $: 550 5.7.0 ${VMsg}
RHappy Allhallowmas $* $#error $: 550 5.7.0 ${VMsg}
RHave a good Allhallowmas $* $#error $: 550 5.7.0 ${VMsg}
RW32 . Klez . E removal tools $* $#error $: 550 5.7.0 ${VMsg}
RRe : Approved $#error $: 550 5.7.0 ${VMsg}
RRe : Details $#error $: 550 5.7.0 ${VMsg}
RRe : Re : My details $#error $: 550 5.7.0 ${VMsg}
RRe : Thank you ! $#error $: 550 5.7.0 ${VMsg}
RRe : That movie $#error $: 550 5.7.0 ${VMsg}
RRe : Wicked screensaver $#error $: 550 5.7.0 ${VMsg}
RRe : Your application $#error $: 550 5.7.0 ${VMsg}
RThank you ! $#error $: 550 5.7.0 ${VMsg}
RYour details $#error $: 550 5.7.0 ${VMsg}






This article comes from NukeCops
http://www.nukecops.com

The URL for this story is:
http://www.nukecops.com/modules.php?name=News&file=article&sid=521