Subject: Re: recommendations for virus/worm scanning software?
To: None <firstname.lastname@example.org>
From: Martin J. Laubach <email@example.com>
Date: 09/21/2003 13:00:16
| > > this RE apparently just meatches a
| > > MIME/BASE64 encoded W32 ELF header):
| > >
| > > ^TV[nopqr][A-Z]...[AB]..A.A....*AAAA...*AAAA
| > Some quick poking and I couldn't find any reference to this. What's
| > your source?
| I have no idea. That doesn't read like a postfix configuration line anyway.
/^TVqQAAMA/ REJECT Your mail contains windows executable, this is pr
obably a virus.
in my filter rules for ages, and it works pretty well to catch
that crap. I have seen varations of that (like the quoted one above
or with a longer trailer to exactly match W32 headers only).