RE: Re: Filtering sobig with postfix

["Bojan Zdrnja" <Bojan.Zdrnja () LSS hr>]

> -----Original Message-----
> From: Craig Pratt [mailto:craig () strong-box net] 
> Sent: Thursday, 21 August 2003 5:52 p.m.
> To: Bojan.Zdrnja () LSS hr
> Cc: full-disclosure () lists netsys com
> Subject: Re: [Full-disclosure] Re: Filtering sobig with postfix
>
> You'd better check for a lot more than just .pif files. .scr and .exe 
> files are critical as well.

Of course, the list is much longer, but original question was about stopping
Sobig-F, which sends itself only as a .pif file.

> If you want to really filter stuff, look at something like MailScanner 
> (http://www.mailscanner.info) which has file-type/mime-type 
> checking as 
> just the first line of defense. The power and configurability of this 
> system is amazing. It works with postfix and sendmail, and lots of 
> virus scanners - if you choose to integrate one.

For combination with postfix, I'd suggest amavisd-new. It has very good
performance, includes spamassassin for spam filtering and works really nice.

Regards,

Bojan Zdrnja

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html