New User? Need help? Click here to register for free! Registering removes the advertisements.

Computer Cops
image image image image image image image image
Donations
If you found this site helpful, please donate to help keep it online
Don't want to use PayPal? Try our physical address
image
Prime Choice
· Head Lines
· Advisories (All)
· Dnld of the Week!
· CCSP News Ltrs
· Find a Cure!

· Ian T's (AR 22)
· Marcia's (CO8)
· Bill G's (CO11)
· Paul's (AR 5)
· Robin's (AR 2)

· Ian T's Archive
· Marcia's Archive
· Bill G's Archive
· Paul's Archive
· Robin's Archive
image
Security Central
· Home
· Wireless
· Bookmarks
· CLSID
· Columbia
· Community
· Downloads
· Encyclopedia
· Feedback (send)
· Forums
· Gallery
· Giveaways
· HijackThis
· Journal
· Members List
· My Downloads
· PremChat
· Premium
· Private Messages
· Proxomitron
· Quizz
· RegChat
· Reviews
· Google Search
· Sections
· Software
· Statistics
· Stories Archive
· Submit News
· Surveys
· Top
· Topics
· Web Links
· Your Account
image
CCSP Toolkit
· Email Virus Scan
· UDP Port Scanner
· TCP Port Scanner
· Trojan TCP Scan
· Reveal Your IP
· Algorithms
· Whois
· nmap port scanner
· IPs Banned [?]
image
Survey
How much can you give to keep Computer Cops online?

$10 up to $25 per year?
$25 up to $50 per year?
$10 up to $25 per month?
$25 up to $50 per month?
More than $50 per year?
More than $50 per month?
One time only?
Other (please comment)



Results
Polls

Votes: 887
Comments: 19
image
Translate
English German French
Italian Portuguese Spanish
Chinese Greek Russian
image
image emailserv: Malware: (Re-Broadcast) Rejecting SOBIG & More Virus Emails with Sendmail image
Email Servers
Rejecting SOBIG & More Virus Emails with Sendmail

Hi folks, I wrote a nice sendmail filter to block email messages based on the subject header. So instead of my blocking the email addresses I mentioned earlier due to Sobig, I now changed it to this instead. I tested it using Sendmail interactively as well as sending email to local accounts from Yahoo

##

## Common Virus Subjects

##

HSubject: $>Check_Subject

D{VMsg} - [EXT_VMSG] This message may contain a virus - see http://computercops.biz/anti-spam.html



SCheck_Subject

R$* ILOVEYOU $* $#error $: 550 5.7.0 ${VMsg}

RA funny game $* $#error $: 550 5.7.0 ${VMsg}

RA special nice game $* $#error $: 550 5.7.0 ${VMsg}

RRe : some questions $* $#error $: 550 5.7.0 ${VMsg}

RHappy Allhallowmas $* $#error $: 550 5.7.0 ${VMsg}

RHave a good Allhallowmas $* $#error $: 550 5.7.0 ${VMsg}

RW32 . Klez . E removal tools $* $#error $: 550 5.7.0 ${VMsg}

RRe : Approved $#error $: 550 5.7.0 ${VMsg}

RRe : Details $#error $: 550 5.7.0 ${VMsg}

RRe : Re : My details $#error $: 550 5.7.0 ${VMsg}

RRe : Thank you ! $#error $: 550 5.7.0 ${VMsg}

RRe : That movie $#error $: 550 5.7.0 ${VMsg}

RRe : Wicked screensaver $#error $: 550 5.7.0 ${VMsg}

RRe : Your application $#error $: 550 5.7.0 ${VMsg}

RThank you ! $#error $: 550 5.7.0 ${VMsg}

RYour details $#error $: 550 5.7.0 ${VMsg}
Posted on Wednesday, 20 August 2003 @ 13:00:00 EDT by phoenix22
image

 
Login
Nickname

Password

· New User? ·
Click here to create a registered account.
image
Related Links
· TrackBack (0)
· HotScripts
· W3 Consortium
· Spam Cop
· More about Email Servers
· News by phoenix22


Most read story about Email Servers:
NoHTML for Microsoft Outlook & Outlook Express

image
Article Rating
Average Score: 0
Votes: 0

Please take a second and vote for this article:

Bad
Regular
Good
Very Good
Excellent


image
Options

Printer Friendly Page  Printer Friendly Page

image
"Login" | Login/Create an Account | 14 comments | _SEARCHDIS
Threshold
The comments are owned by the poster. We aren't responsible for their content.

No Comments Allowed for Anonymous, please register

Re: (Re-Broadcast) Rejecting SOBIG & More Virus Emails with Sendmail (Score: 0)
by Anonymous  on Thursday, 21 August 2003 @ 08:57:56 EDT
Where do you enter in that stuff? Sorry for my newbie question.



Re: (Re-Broadcast) Rejecting SOBIG & More Virus Emails with Sendmail (Score: 0)
by Anonymous  on Thursday, 21 August 2003 @ 14:03:45 EDT
OK you wrote the filter, but where did you put it?



Re: (Re-Broadcast) Rejecting SOBIG & More Virus Emails with Sendmail (Score: 0)
by Anonymous  on Friday, 22 August 2003 @ 09:04:00 EDT
I can't get this to work. I tried pasting it into sendmail.cf and sendmail.mc. No luck. Sendmail won't start.

Any ideas?



Re: (Re-Broadcast) Rejecting SOBIG & More Virus Emails with Sendmail (Score: 0)
by Anonymous  on Saturday, 23 August 2003 @ 00:02:42 EDT
I didn't find this method to be that great. It just bounces the email back to the sender (which usually doesn't exist) and then their postmaster just returns it back to you. Waste of bandwidth. I just made a global /etc/procmailrc file and have it filtered to /dev/null;

[root@ren tyler]# more /etc/procmailrc
:0
* ^Subject:.*Your details*
/dev/null

:0
* ^Subject:.*Thank You*
/dev/null


:0
* ^Subject:.*That movie*
/dev/null

:0
* ^Subject:.*Re: Details*
/dev/null

:0
* ^Subject:.*Re: Approved*
/dev/null

:0
* ^Subject:.*Wicked screensaver*
/dev/null

:0
* ^Subject:.*Your application*
/dev/null

:0
* ^Subject:.*My details*
/dev/null


That's the only subjects I know it uses, of course if there's more, you'd have to add more.