[Mimedefang] How to stop Neroma / 911 virus?

Mike Heller mike at dsny.com
Thu Sep 4 15:53:01 EDT 2003


Hello, There is a new virus going around, details are here:

http://sarc.com/avcenter/venc/data/w32.neroma@mm.html

*Subject*: It's Near 911!
*Message*: ice butt baby!
*Attachment*: 911.jpg

I have tried to setup a couple of filters in "filter":

        if ($fname =~ /911/i) {
            syslog('warning', "attachment $fname of type $ext discarded 
W32.Neroma virus.");
            return action_discard();
        }

        if ($Subject =~ /911!/i) {
            syslog('warning', "attachment $fname of type $ext discarded 
W32.Neroma virus.");
            return action_discard();
        }

I tried some other combinations and sent some test messages through and 
they seem to make if fine.  Can anyone help me out and create a filter 
for this virus?

Thanks,
Mike





More information about the MIMEDefang mailing list