Mail from amavisd-new author re viruses_that_fake_sender

bar (text/plain), 1.08 KB, created by Duncan Hill on 2004-03-23 02:24:25 UTC

From: Mark Martinec <[e-mail]>
Subject: Re: [AMaViS-user] W32/Bagle-A
To: [e-mail]
Date: Mon, 19 Jan 2004 14:47:20 +0100

The new W32/Bagle-A is another example of a virus that fakes sender address.
Amavisd-new users are encouraged to update the $viruses_that_fake_sender_re
list in file amavisd.conf to include this name, to prevent notifications
being sent to innocent people.

Here is an example:

$viruses_that_fake_sender_re = new_RE(
  qr'nimda|hybris|klez|bugbear|yaha|braid|sobig|fizzer|palyh|peido|holar'i,
  qr'tanatos|lentin|bridex|mimail|trojan\.dropper|dumaru|parite|spaces'i,
  qr'dloader|galil|gibe|swen|netwatch|bics|sbrowse|sober|rox|val(hal)?la'i,
  qr'be?agle'i,
);

or the other way around, naming only viruses that don't fake sender
address, and ignore the rest. This is now becoming the preferred way,
as almost every decent virus is faking sender addresses nowadays:

$viruses_that_fake_sender_re = new_RE(
  [qr'^(EICAR\.COM|Joke\.|Junk\.)'i    => 0],
  [qr'^(WM97|OF97|W95/CIH-|JS/Fort)'i  => 0],
  [qr/.*/ => 1],   # true by default
);


  Mark