Greetings! On 27 Jan 2004 06:51:55 -0800 [EMAIL PROTECTED] (Randal L. Schwartz) wrote:
>> Patrick> 1. I'm trying to decide on an AV solution for a campus wide >> n/w. Patrick> I'm basically looking for something that'll respond as >> quick as Patrick> possible to new viruses. I'm currently evaluating >> NAV, and Fprot. Patrick> Any other suggestions/recomendations? > > PLEASE MAKE SURE that it doesn't send email responses. > I'm getting 500 mydoom an hour. I can filter those. > I'm getting 1500 AV-responses an hour. I can't filter those. > AV response email is PART OF THE PROBLEM now, not PART OF THE > SOLUTION. e.g. with Postfix MTA you can use the mime_header_checks filtering quite successful and without response mails. And most times it's effective even without pattern updates... (beware of possible line breaks) main.cf: -------- mime_header_checks = regexp:/etc/postfix/mime_header_checks mime_header_checks: ------------------- ### ----------------------------------------------------------------------- # known viri # /^.*(file)?name="?.*(your_details|your_document|document_all).pif.*\.(bat|asd|chm|com|dll|hlp|hta|js|jse|lnk|ocx|pif|scr|shb|shs|vb|vbe|vbs|vxd|wsf|wsh)"?/ DISCARD Found Sobig.F virus - clean your computer. ### ----------------------------------------------------------------------- # temp. virus blocks # /^.*name="?(doc|message|readme|text|test|document)\.zip"?/i DISCARD Probably found Novarg/MyDoom virus - clean your computer or re-send attachment with different name. ### ----------------------------------------------------------------------- # executables # /^\t(file)?name="?.*\.(bat|asd|chm|com|dll|exe|hlp|hta|js|jse|lnk|ocx|pif|scr|shb|shs|vb|vbe|vbs|vxd|wsf|wsh)"?/ DISCARD Found executable attachment. Re-send packed in ZIP archive if valid requirement. /^Content-(Type|Disposition):.* (file)?name="?.*\.(bat|asd|chm|com|dll|exe|hlp|hta|js|jse|lnk|ocx|pif|scr|shb|shs|vb|vbe|vbs|vxd|wsf|wsh)"?/ DISCARD Found executable attachment - probably virus. Re-send packed in ZIP archive if valid requirement. Bye Volker Tanger ITK-Security _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
