Re: [cobalt-users] ###!IMPORTANT! - virus warning - !IMPORTANT!###

[Michael Nielsen <mnielsen@xxxxxxxxxxxxxx>]

Here's something I saw on Bugtraq

Jose Nazario <jose@xxxxxxxxxxxxxxxxxxxxxxxx> has been kind enough to
put up a rulseset for sendmail 8.9.x and 8.10.x that stops messages with
"ILOVEYOU" in the subject file. You can find it at:
http://biocserver.cwru.edu/~jose/iloveyouhack.txt

and this

Sendmail.com has a rule to filter the worm based on the subject header
at http://www2.sendmail.com/loveletter. It works with Sendmail 8.9
and newer. You should probably add "Joke" to the subject lines it
scans for.

Michael

At 7:56 PM -0800 5/4/00, RH Linux wrote:
>i searched for it, couldnt find anything relating to sendmail
>
>
>----- Original Message ----- 
>From: "Daniel Pumphrey" <dpumphre@xxxxxxxxxxxxxxx>
>To: <cobalt-users@xxxxxxxxxxxxxxx>
>Sent: Thursday, May 04, 2000 7:47 PM
>Subject: Re: [cobalt-users] ###!IMPORTANT! - virus warning - !IMPORTANT!###
>
>
> > Take a look at the posts today (5/4/2000) at http://www.slashdot.org - there
> > are a couple of sendmail fixes where you can filter out by the subject
> > line - much like you talk about here for the NT Servers.  This link will get
> > you straight to the story:
> > 
> > http://slashdot.org/articles/00/05/04/0938227.shtml
> > 
> > Good Luck,
> > Daniel
> > 
> > ----- Original Message -----
> > From: Franklin S. Werren <fswerren@xxxxxxxxxxxx>
> > To: <cobalt-users@xxxxxxxxxxxxxxx>
> > Sent: Thursday, May 04, 2000 10:11 PM
> > Subject: Re: [cobalt-users] ###!IMPORTANT! - virus warning - !IMPORTANT!###
> > 
> > 
> > > Hi All
> > >
> > > On several of the NT type e-mail servers, (no yelling please) you can
> > filter
> > > out using the header of the e-mail.
> > > The ISP that host my domain has done that, but it will not work for Linux,
> > > Is there a way to filter out e-mails in a RAQ and RAQ3 ???
> > >
> > > All he added was ILOVEYOU and IL0VEYOU to the block, and did a search of
> > the
> > > e-mail directories looking for the tell tail text that was in this mail.
> > >
> > > Bingo! he deleted 53 messages from the NT mail server and saved alot of
> > > headaches for over 6000 users....
> > > With the block and the deletes he only had several calls about it... with
> > 1
> > > infection so far.
> > >
> > > But the RAQ servers are still vunable to this nasty e-mail...
> > >
> > > Ideas ???
> > >
> > > Franklin S. Werren, webmaster@xxxxxxxxxxxx   www.bagpipes.net
> > > Modem Madness Ringmaster at www.madbbs.com/webring/
> > > ICQ 8556386 or fswerren46 on AOL's IM
> > >
> > > Frank's Radio, P.O. Box 990, Sherman NY 14781-0990
> > >
> > > For the best ISP in Chautauqua County NY and Warren Co. Pa
> > > go to www.madbbs.com    They treat you right.
> > >
> > > >
> > >
> > >
> > > _______________________________________________
> > > cobalt-users mailing list
> > > cobalt-users@xxxxxxxxxxxxxxx
> > > To Subscribe or Unsubscribe, please go to:
> > > http://list.cobalt.com/mailman/listinfo/cobalt-users
> > >
> > 
> > 
> > 
> > _______________________________________________
> > cobalt-users mailing list
> > cobalt-users@xxxxxxxxxxxxxxx
> > To Subscribe or Unsubscribe, please go to:
> > http://list.cobalt.com/mailman/listinfo/cobalt-users
> > 
>
>_______________________________________________
>cobalt-users mailing list
>cobalt-users@xxxxxxxxxxxxxxx
>To Subscribe or Unsubscribe, please go to:
>http://list.cobalt.com/mailman/listinfo/cobalt-users