From: Alan (alanufies.org)
Date: Thu Mar 04 2004 - 13:00:50 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

According to the email the bagle uses a non-standard zip format that is
slightly different in the first few bytes.

This body checks seems to work except that it is blocking mail such at
this, that contains the string :) I've turned it off so I don't get
mail blocked that is on the subject of how to block mail!

alan

On Thu, Mar 04, 2004 at 01:32:26PM -0500, John M. Lockard wrote:
> Won't that just block everything that has a .zip file attached?
>
> On Thu, Mar 04, 2004 at 10:21:00AM -0800, Alan wrote:
> > > If your MTA can block based on patterns in the message body, it should
> > > be possible to block this one at the email gateway. I'm using postfix,
> > > and it's done like this
> > >
> > > main.cf:
> > > body_checks = regexp:/etc/postfix/body_checks
> > >
> > > body_checks:
> > > /UEsDBAoAAQAAA/ HOLD
> >
> > Alan
>
> --
> --jlockard - "Gravity is a harsh mistress." - The Tick

--
Alan <alanufies.org> - http://arcterex.net
--------------------------------------------------------------------
"There are only 3 real sports: bull-fighting, car racing and mountain
climbing. All the others are mere games." -- Hemingway

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]