A better - more lasting solution would be to block all '.vbs'
attachements. The majority of the Outlook viri are vb-script based.
Our mail spool routinely stops all sorts of nasties and works as follows:
1. SMTPD is used to receive Emails, and writes them to a spool directory.
2. Our mail daemon scans files in the spool directory detaching any
attachements.
3. The mail daemon then looks for banned file types. (vbs ect).
4. All attachements are then scanned using commercial virus tools
(Antiviral pro for linux and McAffee for Linux.)
5. If any banned file types or viri are detected, the mail is dropped into
a 'badmail' directory. If the mail is OK - it is dropped into an
outbound mail spool.
6. Clean mails are sent to the local MTA. (sendmail/qmail/exim ect).
7. Bad mails are batched processed, and nasty messages sent to the
originator of the mail.
As the majority of these E-Worms are windows/outlook/vbs, the block on VBS
files stops them from entering our network. The virus scanners take care
of the known viri - predominently excel/word macro viri.
The mail daemon is a fairly simple perl script. I am happy to give to
anybody who wants it. (Just let me know).
My only problem now are the users who use 'Hotmail' ect. But then - web
browsers should not be affected as badly. (I hope!)
Cheers
Jason.
-------------------------------------------------
On Fri, 5 May 2000, Aussie wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 5 May 00, at 13:48, Howard Lowndes wrote:
>
> <<SNIP>>
> > At 6:00 this morning I went around all of my managed sites and patched
> > their sendmail to block suspect emails, all whilst I was still in my
> > jammies. Try doing that with that other toy.
>
> Going to work in your pj's.......PRICELESS :-)
>
> Aussie
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGP 6.0.2 -- QDPGP 2.60
> Comment: Please verify this signature. http://www.pgpi.com
>
> iQA/AwUBORG6VpZb9oayhFBBEQLFXACbBuDcwVolgpRsbkoAstQ22ZwCXXwAoOU6
> fmxJleTRUsbIcf/tcvMEzAya
> =lzff
> -----END PGP SIGNATURE-----
>
> PGP Key Block available at:
> http://aussie.mine.nu/aussie/pgp_key.txt
> --
> SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au
> To unsubscribe send email to [EMAIL PROTECTED] with
> unsubscribe in the text
>
---
Jason Ball
Electronic Commerce Specialist
Corporate Express Australia Ltd
Phone: +61 2 9335 0374 Fax: +61 2 9335 0753
Email: [EMAIL PROTECTED]
--
SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au
To unsubscribe send email to [EMAIL PROTECTED] with
unsubscribe in the text
