From: opennet.ru
Subj : Борьба с червями на примере SirCam (фильтрация писем по содержимому тела письма и заголовкам)
________________________________________________________________________________
В статье приводятся примеры кода блокировки распространения сетевого червя
SirCam для procmail, sendmail, postfix и qmail.
# Filtering for Sircam virus
# by morcego and Elgio Schlemer
# For usage on /etc/procmailrc
#
:0 HB
* ^Content-Type: application/mixed;
name=.*..*(.com|.lnk|.pif|.exe|.bat)"?$
{
:0 c
| (formail -r -i"From: antivirus - SirCam virus detected
<antivirus@liveware.com.br>" -A"X-Loop: antivirus";
cat /etc/mail/virus-sircam.msg)|$SENDMAIL -oi -t
:0
/dev/null
}
Другой вариант решения проблемы через procmail (для помещения в /etc/procmailrc или ~/.procmailrc)
:0 Bh
*I send you this file in order to have your advice
*daeLRCQEM9KJEIN8JAwAdBmLRCQEi1QkCIkQi0QkDCtEJAiLVCQEiUIEg8QUXV9eW8NTVldV
|(formail -rtb -I "Precedence: junk"
-I "Subject: SirCam Virus Spam Worm";
echo "Your computer is infected with the SirCam worm. Please see";
echo "http://www.wired.com/news/technology/0,1282,45427,00.html for more information.")
|$SENDMAIL -oi -t
Третий вариант:
В procmailrc:
SUBJECT=`formail -xSubject:
| sed -e 's/[;`\]/ /g'
| expand | sed -e 's/^[ ]*//g' -e 's/[ ]*$//g'`
:0 B:
* $ ^Content-Type: application/mixed; name=.*"$SUBJECT".*
{
:0 hc:
* ^X-Mailer: Microsoft
* ^Content-Type: multipart/mixed;
| (formail -r -I "Subject: "SirCam" Worm Warning";
echo "Your machine appears to be infected with the ";
echo ""SirCam" Email Worm. As a result, you sent me a file ";
echo "called "$SUBJECT" which also contains this worm. ";
echo;
echo "Please see ";
echo "http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.html ";
echo "for instructions on how to remove the worm.";
) | $SENDMAIL -t
#########################################################################
#
# w32.sircam.worm@mm
#
# There are serveral patterns that appear common ONLY to SirCam worm and
# not to Outlook Express, which claims to have sent the worm. There are
# four headers that always appear together and in this order:
#
# X-MIMEOLE: Produced By Microsoft MimeOLE V5.50.4133.2400
# X-Mailer: Microsoft Outlook Express 5.50.4133.2400
# Content-Type: multipart/mixed; boundary="----27AA9124_Outlook_Express_message_boundary"
# Content-Disposition: Multipart message
#
# Empirical study of the worm message headers vs. true Outlook Express
# (5.50.4133.2400 & 5.50.4522.1200) messages with multipart/mixed attachments
# shows Outlook Express does:
#
# a) NOT supply a Content-Disposition header for multipart/mixed messages.
# b) NOT specify the header X-MimeOLE header name in all-CAPS.
# c) NOT specify boundary tag with the expression "_Outlook_Express_message_boundary"
#
# The solution below catches any one of this three issues. This is not an ideal
# solution, but a temporary measure. A correct solution would be to check for
# the presence of ALL three header attributes. Also the solution is incomplete
# since Outlook Express 5.0 and 4.0 were not compared.
#
#########################################################################
KSirCamWormMarker regex -f -aSUSPECT multipart/mixed;boundary=----.+_Outlook_Express_message_boundary
SCheckContentType
R$+ $: $(SirCamWormMarker $1 $)
RSUSPECT $#error $: "553 Possible virus, see http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.html"
SCheckContentDisposition
RMultipart message $#error $: "553 Possible virus, see http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.html"
SCheckForWorms
R$+ $#error $: "553 Possible virus, see http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.html"
475 Прочтений • [Борьба с червями на примере SirCam (фильтрация писем по содержимому тела письма и заголовкам) (sendmail mail postfix qmail filter procmail example)] [08.05.2012] [Комментариев: 0]
Vova
