RE: [Full-Disclosure] Re: Filtering sobig with postfix

["Bojan Zdrnja" <Bojan.Zdrnja@LSS.hr>]

> -----Original Message-----
> From: Craig Pratt [mailto:craig@strong-box.net] 
> Sent: Thursday, 21 August 2003 5:52 p.m.
> To: Bojan.Zdrnja@LSS.hr
> Cc: full-disclosure@lists.netsys.com
> Subject: Re: [Full-Disclosure] Re: Filtering sobig with postfix
> 
> You'd better check for a lot more than just .pif files. .scr and .exe 
> files are critical as well.

Of course, the list is much longer, but original question was about stopping
Sobig-F, which sends itself only as a .pif file.

> If you want to really filter stuff, look at something like MailScanner 
> (http://www.mailscanner.info) which has file-type/mime-type 
> checking as 
> just the first line of defense. The power and configurability of this 
> system is amazing. It works with postfix and sendmail, and lots of 
> virus scanners - if you choose to integrate one.

For combination with postfix, I'd suggest amavisd-new. It has very good
performance, includes spamassassin for spam filtering and works really nice.

Regards,

Bojan Zdrnja

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html