metamail and klez...

metamail and klez...

[Jens Knoell]

I've got an interesting problem:

My mail filter uses metamail to break incoming mail apart and look into
possibly dangerous attachments. It does fail for Klez-infected eMails, and I
am a little at a loss how to fix it:
------<snip>-----
> metamail -w -x infected.eml
Date: Tue, 30 Apr 2002 07:38:25 +0200 (MET DST)
From: info <info@eib.org>
To: jens@ing.twinwave.net
Subject: CELLPADDING

Ignoring unparsable content-type parameter: ''
Cannot handle any part of multipart/alternative message
-----</snip>-----

Any idea why it's puking on it, and how to get to the two attachments?

Jens

Re: metamail and klez...

[Horia Chirculescu]

I am using for the same purpose MailScanner with f-prot and procmail.

It does offer protection for that type of viruses. Still, f-prot it is
not able to clean the W32/Klez.H infected files.

This is an alternative to your metamail solution. 

                           ____    ____    o           ~ 
               //     //  / __ \  //   \  // //''''  //\\
              //_____//  / / / / //___ / // //      //  \\
             //     //  / /_/ / // \    // //      //____\\ 
            //     //   \____/ //   \  //  \\.... //      \\
 ------------------------------------------------------------------------
                          Comtec Net Romania
           ----------------------------------------------------
         WEB: www.eltop.ro IRC: irc.eltop.ro NEWS: news.eltop.ro
           ----------------------------------------------------
                    Horia Chirculescu root@eltop.ro
                         Mobil: +40 93 205 086

On Tue, 30 Apr 2002, Jens Knoell wrote:

> I've got an interesting problem:
> 
> My mail filter uses metamail to break incoming mail apart and look into
> possibly dangerous attachments. It does fail for Klez-infected eMails, and I
> am a little at a loss how to fix it:
> ------<snip>-----
> > metamail -w -x infected.eml
> Date: Tue, 30 Apr 2002 07:38:25 +0200 (MET DST)
> From: info <info@eib.org>
> To: jens@ing.twinwave.net
> Subject: CELLPADDING
> 
> Ignoring unparsable content-type parameter: ''
> Cannot handle any part of multipart/alternative message
> -----</snip>-----
> 
> Any idea why it's puking on it, and how to get to the two attachments?
> 
> Jens
> 
> -
> To unsubscribe from this list: send the line "unsubscribe linux-admin" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

Re: metamail and klez...

[Scott Taylor]

On Tue, 30 Apr 2002, Jens Knoell wrote:

> I've got an interesting problem:
>
> My mail filter uses metamail to break incoming mail apart and look into
> possibly dangerous attachments. It does fail for Klez-infected eMails, and I
> am a little at a loss how to fix it:

Procmail. :)

Re: metamail and klez...

[Nicolas Costes]

Le Mardi 30 Avril 2002 12:00, Scott Taylor a écrit :
> On Tue, 30 Apr 2002, Jens Knoell wrote:
> > I've got an interesting problem:
> >
> > My mail filter uses metamail to break incoming mail apart and look into
> > possibly dangerous attachments. It does fail for Klez-infected eMails,
> > and I am a little at a loss how to fix it:
>
> Procmail. :)

Amavis, http://www.amavis.org ... For use with postfix, sendmail, with 
mcafee, sophos, etc... Well, I don't know if it works with an email client... 
Use the daemon version (amavisd) !!!

-- 
 ( °> Nicolas Costes
 //\\  IUT de La Roche / Yon
/ \/ ) Nicolas.costes@iut-laroche.univ-nantes.fr
`-<<  http://luxregina.free.fr
-
To unsubscribe from this list: send the line "unsubscribe linux-admin" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html