Kurth Bemis wrote:
> I own a ISP and we're having problems with the "Snowhite Virus" and outlook
> users...its running rampant..from about 3 weeks back we got one or 2
> bounces a week..now we're up to 40 a day....
It's not just Outlook users. It does much more than just read their
address book. See http://www.vet.com.au/html/zoo/descriptions/hybris.htm
for more info.
> I have created a controls/badmailfrom and added [EMAIL PROTECTED] however
> mail still goes though....any ideas why this isn't rejecting mail?
Yes. The badmailfrom file rejects mail that has the "MAIL FROM:" field
in the file. If you look at the mail headers closely, you'll see that
the MAIL FROM: field is actually "<>" and it's the "From:" field that is
"Hahaha <[EMAIL PROTECTED]>".
Try using qmail-scanner to solve this problem. You don't need a virus
scanner to do it - the quarrantine-attachements.txt file will let you
block the mail.
Cheers,
--
Andrew Hill
"Right now, I'd happily snort gunk from the sink if it would take
my brain somewhere away from here...." - JB
