On Thursday, August 21, 2003, 21:40:27, daniel hahler wrote: > Mine does, so I scan for this. It's also a good idea to delete the > mail from the server.
Be careful, there are actual anti-virus programs which add that header to real messages... > Don't know, if the "(see the attached file for details)" part is in > every mail, but for me it is. Sobig.F uses the following two strings in the body, so it's more reliable to filter on them: See the attached file for details Please see the attached file for details. > From now on there are only the virus-alerts at mails, that were > spoofed with my adress.. "Mailbox quota exceeded" are also rising.. :/ > but somehow GMX or someone else has done sth, as I didn't get any new > the last hour..?! I'm much more annoyed by the stupid antivirus auto-responders which have flooded my mailbox. Here's my filter-in-progress which responds to those messages and moves them out of the way: ========8<-------------------------------------------------------------- BeginFilter Name: Anti-Antivirus Active: 1 Source: \\Jernej Simončič\Inbox Target: \\Jernej Simončič\Inbox\AV CopyFolder: \\\\none MainSet: 30because contains an infected object. MainSet: 01arnes.si AltSet:1: 30that was infected with AltSet:1: 30a known virus. AltSet:1: 01arnes.si AltSet:2: 30Problem: Virus found AltSet:2: 01arnes.si AltSet:3: 20Virus Alert AltSet:3: 01arnes.si AltSet:4: 20InterScan NT Alert AltSet:4: 01arnes.si AltSet:5: 30sent to the recipients listed above was AltSet:5: 30infected with AltSet:5: 01arnes.si AltSet:6: 20Virus found AltSet:6: 01arnes.si AltSet:7: 30This e-mail appears to contain a virus. AltSet:7: 01arnes.si AltSet:8: 30has been found to contain a virus AltSet:8: 01arnes.si AltSet:9: 30The Illegal attachment type was reported to be: AltSet:9: 30VirusMail AltSet:9: 01arnes.si AltSet:10: 20VIRUS IN YOUR MAIL AltSet:10: 01arnes.si AltSet:11: 30contained the virus AltSet:11: 01arnes.si AltSet:12: 20Norton AntiVirus detected a virus in a message you sent AltSet:12: 01arnes.si AltSet:13: 20Norton AntiVirus detected and quarantined a virus AltSet:13: 01arnes.si AltSet:14: 20Virus Detected AltSet:14: 40From: AltSet:14: 01arnes.si AltSet:15: 20Virus Detected AltSet:15: 40Reply-To: AltSet:15: 01arnes.si AltSet:16: 30above was infected with the AltSet:16: 01arnes.si AltSet:17: 30ANTIVIRUS SYSTEM FOUND VIRUSES AltSet:17: 01arnes.si Actions: faAutoReply AddGroups: DelGroups: ForwardTemplate: ConfirmTemplate: ReplyTemplate: Stop\20flooding\20me\20with\20your\20messages,\20I\20have\20no\20viruses.\20It\27s\20widely\20known\0D\0Athat\20Sobig.F\20&\20co\20use\20random\20e-mails\20in\20the\20From\20field.\20This\20is\20an\20automatic\0D\0Areply.\0D\0A\0D\0A%Quotes\0D\0A FwdAddr: RedirectAddr: NewAddr: NewTemplate: ExtCmd: ExtFile: ExtractDir: ColourGroup: <default> AddAddrItems: afiFrom, DelAddrItems: afiFrom, HotKey: 0 IsOfColour: <default> SizeBigger: 0 SizeSmaller: 0 AgeOlder: 0 AgeNewer: 0 InAddrPos: 0 OutAddrPos: 0 InAddrGroups: NoAddrGroups: KillFile: KillMethod: 0 SaveTemplate: SndFile: SysSound: 0 SoundTime: 0:00-0:00 AllowTime: 0:00-0:00 EndFilter ========8<-------------------------------------------------------------- (replace arnes.si with your own e-mail domain, since some idiotic autoresponses contain your provider's postmaster address instead of their). -- Jernej Simoncic, [EMAIL PROTECTED] http://www2.arnes.si/~sopjsimo/ http://deepthought.ena.si/ Being frustrated is disagreeable, but the real disasters in life
________________________________________________ Current version is 1.62r | "Using TBUDL" information: http://www.silverstones.com/thebat/TBUDLInfo.html
