[cobalt-users] RaQ2 - CERT virus rule for sendmail - question

[Diana Brake <diana@xxxxxxxxxxxxx>]

Hi,

I applied this rule from CERT to the sendmail.cf file...at the bottom of 
the file

#
#Rule from CERT for ILOVEYOU Virus Filter
#
HSubject:                       $>Check_Subject
D{MPat}ILOVEYOU
D{MMsg}This message may contain the ILOVEYOU virus
SCheck_Subject
R${MPat} $*     $#error $: 553 ${MMsg}
RRe: ${MPat} $* $#error $: 553 ${MMsg}
RRe: ${MPat} $* $#error $: 553 ${MMsg}

(*tabs in all the correct places)

and it worked great. Messages sent with the exact words "ILOVEYOU" in the 
subject were refused. "I love you" was not. "Iloveyou" was refused also but 
if there were words added to the subject line such as "ILOVEYOU from me", 
this was allowed to pass through. All email on the server seemed to be 
working great..all users and their aliases were working. This morning, it 
came to my attention the fmail.pl forms and the shopping cart we use were 
not sending properly. fmail forms were talking to the server properly, the 
user got the proper response/receipt..(no errors), but the recipient never 
got the orders. Every user/alias on our system that was using a form/cart 
was unable to receive orders from users/buyers.

E-mail sent directly to the affected users was delivered properly. Only 
mail to them that was being processed through a form was undelivered.
I didn't think of sendmail until I had searched the server for stuck mail 
or locked accounts, but found that everything was fine, I remembered the 
addition to sendmail.cf. I replaced my backup file of sendmail.cf (thank 
God I remembered that detail) and all forms/scripts work again.
Does someone have an explanation? I ask even thought things work now 
because I have had problems recently with ONE client not being able to use 
a shopping cart, and any explanation I get for this problem may point me in 
the proper direction for my other problem.
Thanks very much,
Diana Brake
Crest Communications, Inc.		diana@xxxxxxxxxxxxx
Beautiful Sunny Florida		http://crestcommunications.com/
352-495-9359