Re: new worm going around - results

[Steven Pritchard <steve@silug.org>]

On Thu, Jan 22, 2004 at 03:38:51AM -0600, Bryan J. Smith wrote:
> Not that I run Windows and, even if I did, I would not practice
> _professionally_negligence_ by running Outlook/IE (just like I was never
> so and ran DOS-based Windows, when NT-based Windows existed), but
> are you just testing file extension and/or MIME type, or are you
> actually testing file magic (i.e. actual bytes of the file)?

File magic.

And I certainly don't run Windows either, but a) the emails are just
overly annoying spam, and b) some people on the list do run Windows,
and Outlook, so I feel the need to protect them from themselves.  ;-)

> Now that Microsoft has bought the best and most cost effective
> Linux-based Windows e-mail virus scanner on the market, what are you
> going to be using?

Amavis (http://www.amavis.org/) and Clam AV (http://clamav.sf.net/),
although something like 98% of the virus mails going through one
client's (very heavily used) mail server are blocked by a couple of
body_checks and header_checks lines in Postfix.

Steve
-- 
steve@silug.org           | Southern Illinois Linux Users Group
(618)398-7360             | See web site for meeting details.
Steven Pritchard          | http://www.silug.org/

-
To unsubscribe, send email to majordomo@silug.org with
"unsubscribe silug-discuss" in the body.