W32/Sobig.F virus header

[Peter Peters]

On Thu, 21 Aug 2003 08:55:33 -0700, you wrote:

>> I know of at least one idiot who's filtering on "X-MailScanner: Found to be clean".
>> Hope they didn't want any mail from some mailscanner users.
>
>So far, I've seen two things posted to the NANOG (North American Network
>Operators Group) mailing list, which is at least monitored by most ISPs.
>The first was a postfix regex to block the message at SMTP time, the
>second was a SpamAssassin rule. I tried mailing the person who sent the
>postfix regex, but, of course, my e-mail was rejected...

Just correct your configuration to reflect te organization in the
X-header (like mine).

I e-mailed the person who had this filter and I did get through.

We now only have to wait untill a viruswriter decides to randomize the
X-MailScanner header. Or to include the organizations name in it.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ