Dumaru again

[Chris Stone]

Try changing in your rules file

FromOrTo:       @mydomain.de            yes

to:

FromOrTo:       *@mydomain.de            yes



-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf
Of Muenz, Michael
Sent: Thursday, March 25, 2004 8:35 AM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Dumaru again

Hi,

On my Spamscanner machine I got a copy of that Dumaru worm.
With SCP i copied it to the machine where F-Prot and MailScanner
runs and did a manual check with F-Prot:
Results of virus scanning:

Files: 1
MBRs: 0
Boot sectors: 0
Objects scanned: 3
Infected: 1
Suspicious: 0
Disinfected: 0
Deleted: 0
Renamed: 0

---

But MailScanner hasn't detect it.
I got a rule in MailScanner for Virus Scan:
FromOrTo:       @mydomain.de            yes
FromOrTo:       default                         no

The infected mail was sent to:
MyDomain.de
Could it be that writing of rules is case sensitive ?

- Michael