## -----------------------------------------------------------------------

# Blocking for W32.Sobig.F@mm



if $header_subject: matches "Re: Approved|Re: Details|Re: My details|Re: Thank you!|Re: That movie|Re: Wicked screensaver|Re: Your application"

then

 fail text "This message has been rejected since it hasn

            the signature of a known virus (W32.Sobig.F@mm) in the subject header.n

            If you believe this bounce message is in error, Pleasen

            change the subject field of your email and re-send.n

            The URL below has more information on W32.Sobig.F@mm:n

            [url="http://www.securityresponse.symantec.com/avcenter/venc/data/w32.sobig.f@mm.html"]http://www.securityresponse.symantec.com/a...big.f@mm.html"[/url]

 seen finish

endif





if $message_body matches "See the attached file for details|Please see the attached file for details"

then

 fail text "This message has been rejected since it hasn

            the signature of a known virus (W32.Sobig.F@mm)in the message body.n

            If you believe this bounce message is in error, Pleasen

            change the message body of your email and re-send.n

            The URL below has more information on W32.Sobig.F@mm:n

            [url="http://www.securityresponse.symantec.com/avcenter/venc/data/w32.sobig.f@mm.html"]http://www.securityresponse.symantec.com/a...big.f@mm.html"[/url]

 seen finish

endif



## -----------------------------------------------------------------------

*** START CONF FILE TEXT ***

## -----------------------------------------------------------------------

# Only run any of this stuff on the first pass through the

# filter - this is an optomisation for messages that get

# queued and have several delivery attempts

#

# we express this in reverse so we can just bail out

# on inappropriate messages

#

if not first_delivery

then





# Look for .pif, .scr or .exe in files and REMOVE them!

if $header_content-type: matches "(?:file)?name=("[^"]+.(?:ad[ep]|exe|pif|scr)")"

then

seen finish

endif

# same again using unquoted filename [content_type_unquoted_fn_match]

if $header_content-type: matches "(?:file)?name=(S+.(?:ad[ep]|exe|pif|scr))"

then

seen finish

endif

## -----------------------------------------------------------------------

# Look for .pif, .scr or .exe in files and REMOVE them!

# Quoted filename - [body_quoted_fn_match]

if $message_body matches "(?:Content-(?:Type:(?>s*)[w-]+/[w-]+|Disposition:(?>s*)attachment);(?>s*)(?:file)?name=|begin(?>s+)[0-7]{3,4}(?>s+))("[^"]+.(?:ad[ep]|exe|pif|scr)")[s;]"

then

seen finish

endif



# same again using unquoted filename [body_unquoted_fn_match]

if $message_body matches "(?:Content-(?:Type:(?>s*)[w-]+/[w-]+|Disposition:(?>s*)attachment);(?>s*)(?:file)?name=|begin(?>s+)[0-7]{3,4}(?>s+))(S+.(?:ad[ep]|exe|pif|scr))[s;]"

then

seen finish

endif





finish

endif

## -----------------------------------------------------------------------

# Only run any of this stuff on the first pass through the

# filter - this is an optomisation for messages that get

# queued and have several delivery attempts

#

# we express this in reverse so we can just bail out

# on inappropriate messages

#

if not first_delivery

then

 finish

endif



## -----------------------------------------------------------------------

# Check for MS buffer overruns as per BUGTRAQ.

# [url]http://www.securityfocus.com/frames/?content=/templates/article.html%3Fid%3D61[/url]

# This could happen in error messages, hence its placing

# here...

# We substract the first n characters of the date header

# and test if its the same as the date header... which

# is a lousy way of checking if the date is longer than

# n chars long

if ${length_80:$header_date:} is not $header_date:

then

noerror fail text "This message has been rejected because it hasn

            an overlength date field which can be usedn

            to subvert Microsoft mail programsn

            The following URL has further informationn

            [url]http://www.securityfocus.com/frames/?content=/templates/article.html%3Fid%3D61[/url]"

 seen finish

endif



## -----------------------------------------------------------------------

# These messages are now being sent with a <> envelope sender, but

# blocking all error messages that pattern match prevents

# bounces getting back.... so we fudge it somewhat and check for known

# header signatures.  Other bounces are allowed through.

if $header_from: contains "@sexyfun.net"

then

 noerror fail text "This message has been rejected since it hasn

            the signature of a known virus in the header."

 seen finish

endif

if error_message and $header_from: contains "Mailer-Daemon@"

then

 # looks like a real error message - just ignore it

 finish

endif



## -----------------------------------------------------------------------

# Look for single part MIME messages with suspicious name extensions

# Check Content-Type header using quoted filename [content_type_quoted_fn_match]

if $header_content-type: matches "(?:file)?name=("[^"]+.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|eml|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|sct|shs|url|vb[se]|ws[fhc])")"

then

 noerror fail text "This message has been rejected because it hasn

            potentially executable content $1n

            This form of attachment has been used byn

            recent viruses or other malware.n

            If you meant to send this file then pleasen

            package it up as a zip file and resend it."

 seen finish

endif

# same again using unquoted filename [content_type_unquoted_fn_match]

if $header_content-type: matches "(?:file)?name=(S+.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|eml|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|sct|shs|url|vb[se]|ws[fhc]))"

then

 noerror fail text "This message has been rejected because it hasn

            potentially executable content $1n

            This form of attachment has been used byn

            recent viruses or other malware.n

            If you meant to send this file then pleasen

            package it up as a zip file and resend it."

 seen finish

endif





## -----------------------------------------------------------------------

# Attempt to catch embedded VBS attachments

# in emails.   These were used as the basis for

# the ILOVEYOU virus and its variants - many many varients

# Quoted filename - [body_quoted_fn_match]

if $message_body matches "(?:Content-(?:Type:(?>s*)[w-]+/[w-]+|Disposition:(?>s*)attachment);(?>s*)(?:file)?name=|begin(?>s+)[0-7]{3,4}(?>s+))("[^"]+.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|eml|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|sct|shs|url|vb[se]|ws[fhc])")[s;]"

then

 noerror fail text "This message has been rejected because it hasn

            a potentially executable attachment $1n

            This form of attachment has been used byn

            recent viruses or other malware.n

            If you meant to send this file then pleasen

            package it up as a zip file and resend it."

 seen finish

endif

# same again using unquoted filename [body_unquoted_fn_match]

if $message_body matches "(?:Content-(?:Type:(?>s*)[w-]+/[w-]+|Disposition:(?>s*)attachment);(?>s*)(?:file)?name=|begin(?>s+)[0-7]{3,4}(?>s+))(S+.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|eml|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|sct|shs|url|vb[se]|ws[fhc]))[s;]"

then

 noerror fail text "This message has been rejected because it hasn

            a potentially executable attachment $1n

            This form of attachment has been used byn

            recent viruses or other malware.n

            If you meant to send this file then pleasen

            package it up as a zip file and resend it."

 seen finish

endif

## -----------------------------------------------------------------------