Re: [cobalt-users] Slightly OT: Blocking BadTrans virus

["Edward Bishop" <eddie@xxxxxxxxxxxxxxxx>]

> > Can any procmail guru provide a simple way of stopping emails with
> > attachments of type .pif or .scr to prevent users getting this virus? Or
> > does anyone know a better way (other than user education which I know is
the
> > best)?
>
> The answer is in the archives. Follow this thread.
>
> http://list.cobalt.com/pipermail/cobalt-users/2001-August/048934.html
>
> HTH,
> j
> --

Thank you Jay. Funnily enough I actually took part several times in the
thread you mention! However, the solution created by Colin J Raven and
discussed there depends on looking for certain signature strings in the body
of the email text. I may be missing something but if not I don't think this
can be used to block BadTrans which attaches itself to any message sent from
an infected client including those it sends by itself without the user's
knowledge.

Judging from the infected emails I've received today I'd say it looks in the
Sent Items folder in OE and does an infected "forward" on all the messages
in there, although I haven't seen this behaviour documented anywhere.

--
Eddie