Hi,
can somebody help me with kill filter, which will delete messages with
attachment without FROM, TO, REPLY-TO etc. fields on server?
As You know, these messages are sent by viruses from infected computer.
Message has attachment like as GOMGJBGO.EXE, BLJUGHOM.EXE, AJEKLMNE.EXE.
I'm including example header:
>From Tue May 15 22:37:11 2001
Return-Path: <>
Received: from u0r4h2 (218-MALA-X32.libre.retevision.es [62.83.107.218])
by iserver.bitest.cz (8.8.7/8.8.7) with SMTP id UAA18375
for <[EMAIL PROTECTED]>; Tue, 15 May 2001 20:41:14 +0200
Date: Tue, 15 May 2001 20:41:14 +0200
Message-Id: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="--VE27ST2N0D6V0PEZK1ERWLUR49MZO5IZW5"
Status: O
----VE27ST2N0D6V0PEZK1ERWLUR49MZO5IZW5
Content-Type: application/octet-stream; name="GOMGJBGO.EXE"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="GOMGJBGO.EXE"
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAgAAAALRMzSEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
--
S pozdravem,
Marek Mikus
\-------------------/
| Marek Mikus |
| [EMAIL PROTECTED] |
>-------------------<
| ISP IPEX s.r.o. |
| 05/452 451 11 |
| www.gin.cz |
/-------------------\
--
______________________________________________________
Archives : <http://tbtech.thebat.dutaint.com>
Moderators : <mailto:[EMAIL PROTECTED]>
Unsubscribe: <mailto:[EMAIL PROTECTED]>
You are subscribed as : [email protected]
