----- Original Message ----- From: "Brian Robson" <[EMAIL PROTECTED]>
> My ISP has just implemented the new policy of removing all M$ executables. > Zipped files are still ok. The result is heaven; my email downloads much > fazster and the daily viruses have stopped. The idea that .scr and .pif and > .bat files are all executables is farcical. I agree with you Brian, I got sick of Swen.A and turned on body_checks in out postfix config. Here is what I did: body_checks = regexp:/etc/postfix/body_checks.regexp and the contents of body_checks.regexp: # Some basic antivirus checks /^Content-Disposition:attachment;filename=\".*\.(doc|zip|exe|xls|jpg|gif)\.( pif|bat|com|exe|lnk)\"$/ REJECT /^Content-Disposition:attachment;filename=.*\.(doc|zip|exe|xls|jpg|gif)\.(pi f|bat|com|exe|lnk)$/ REJECT # Common virus extensions that most people wouldnt send legitamitely /(filename|name)=".*\.(asd|chm|hlp|hta|js|ocx|pif|bat)"/ REJECT /(filename|name)=.*\.(asd|chm|hlp|hta|js|ocx|pif|bat)/ REJECT /(filename|name)=".*\.(scr|shb|shs|vb|vbe|vbs|wsf|wsh)"/ REJECT /(filename|name)=.*\.(scr|shb|shs|vb|vbe|vbs|wsf|wsh)/ REJECT /(filename)=".*\.(com)"/ REJECT /(filename)=".*\.(exe)"/ REJECT /(filename)=.*\.(com)/ REJECT /(filename)=.*\.(exe)/ REJECT #added exe block above after recinving lots of Gibe.b # Specific virus attachments; we dont block .exe by default /(filename|name)="(WTC|wtc|README)\.EXE"/ REJECT /(filename|name)="(Happy99|Navidad|prettypark|prettypark|zipped_files|flcss| Msinit|wininit|msi216|readme|README|Avp_updates|Qi_test|Anti_cih)\.exe"/ REJECT /(filename|name)="(dhcp*|Emanuel|kmbfejkm|NakedWife|Seicho_no_ie|JAMGCJJA|Su lfnbk)\.exe"/ REJECT /(kak|day)\.(reg|hta)/ REJECT # Bugbear virus /(filename|name)=".*\.(.*)\.(pif|scr|bat|com|exe|lnk)"$/ REJECT /^TV[nopqr]....[AB]..A.A....*AAAA...*AAAA/ REJECT /^M35[GHIJK].`..`..*````/ REJECT Note that last two lines are very effective at removing nearly all windows executables. we pump about 5000 messages a day through our server and postfix has barely broken a sweat even with these body checks on here. I think pcre is faster but I haven't read up on it. Anyone played with pcre? dave -- SLUG - Sydney Linux User's Group - http://slug.org.au/ More Info: http://lists.slug.org.au/listinfo/slug
