A couple things, first F-Prot and declude on your mail server would not block the virus, since if I read your message right is linked to a website and not sent as an attachment. I can think of a couple options for this though. First, you could setup a rule in imail to delete or forward to an admin any messages that have that subject. Another option if you are running content filtering software on your internet connect would be to block that particular website. If you really want to get creative you can also block the ip address for that site on a router or firewall access list (currently the ip for that site is 66.216.74.58. Just be aware if you block the ip address of that server and it later changes your acl will no longer apply, the same thing with the message subject blocking, if it changes your filters will not longer work.
Jim Matuska Jr. Computer Tech II CCNA Nez Perce Tribe Information Systems [EMAIL PROTECTED] ----- Original Message ----- From: "Piero" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, October 24, 2003 10:02 AM Subject: [Declude.Virus] New italian virus ? > Hi, > First sorry for my bad english... > > I've received a mail which contain the follow italian text: > Subject: Il momento � catartico > > "Ricevo e cortesemente inoltro,.... un premio per la genialit� > hanno reso mitico un salva schermo scaricalo, "poesie catartiche", che non > sai cosa ti perdi > > ciao" > > The text "poesie catartiche" is a link to : > http://www.francescone.com/index.html which prompt to download a scr file. > F-prot updated, do not block this file. > > But installing screensaver seems that a indipendent Smtp send email to > address which are in Address List in outlook. > > Two question: > - How to block each email which have "il momento � catartico" in subject > - Someone could tell me which email address I can send this file to check if > it is a virus and to add to new definition ? > > Thanks in advance. > > Piero > Italy > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
