I haven't worked on this in the last week, however the following filter takes care of most virus notifications on my system.
http://www.mailpure.com/software/decludefilters/anti-av/Anti-AV_v1-0-2.zip
Unfortunately there is no good way to separate unknown user or full account NDR's from some others, however you can uncomment the null sender line in this filter to add some points so that any suggestive hit will put it over the top. You can also set up a filter with just the null sender and block (hold) that per domain when outbreaks are particularly bad, but bare in mine that legit bounces can be blocked as well.
Matt
Markus Gufler wrote:
I don't know how many NDRs caused from Email-worms are comming in on other Mail servers but here I can see far more then "normal" spam that is delivered to the recipients mailbox. So at the moment I consider this a bigger problem then spam.
The only idea I have at the moment is to introduce combined tests, that allwos use to search for appearences of multiple BODY phrases and maybe also MAILFROM. (For example see attached and zipped file.)
None of this filter entries or entire filter files should be able to block a message but if it would be possible to define combined tests like
BLOCK_WORM_NDR FILTER_POSTMASTER and FILTER_FAILED and (FILTER_SUBJECTS or FILTER_ATTACHMENTS)
then we could set an action
BLOCK_WORM_NDR HOLD
and so - I guess - filter out most of this annoying NDRs. This days our customers are calling us because they receive dozens and hundreds of NDRs, and not because they dont want spam.
Pleeeeeaaaaaaseeeeee :-)
Markus
-- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
