Bon j'ai fini par rendre la regle un poil plus efficace, a savoir que sous linux j'ai jamais besoin d'executables windows, et que les zip c gentil mais pas qd ca ressemble au MyDoom:
# Piege a worm con qui se fout sous la forme d'un exe win32
:0 BD:
* name=".*\.(scr|bat|pif|cmd|exe)"
"${MAIL_DIR}/junk"
# le piege a MyDoom proprement dit
:0 BHD :
* -700^0
* 100^0 > 30000
* 100^0 < 36000
* 100^0 ^Subject: (Mail Delivery System|Hi|Hello|hello|Test|test|Status)
* 100^0 ^X-Priority: 3
* 100^0 ^X-MSMail-Priority: Normal
* 100^0 Content-Type: text/plain;
* 100^0 charset="Windows-1252"
* 100^0 Content-Type: multipart/mixed;
* 100^0 ^The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment\.
* 100^0 ^The message contains Unicode characters and has been sent as a binary attachment\.
* 100^0 ^Mail transaction failed. Partial message is available\.
# just test the zip extension as usual extensions get trapped by the
# "dumb worms" rule
* 100^0 name=".*\.zip"
"${MAIL_DIR}/junk"
# Re: Encore un Worm.
Posté par Edouard Gomez . En réponse au journal Encore un Worm.. Évalué à 3.
# Piege a worm con qui se fout sous la forme d'un exe win32 :0 BD: * name=".*\.(scr|bat|pif|cmd|exe)" "${MAIL_DIR}/junk" # le piege a MyDoom proprement dit :0 BHD : * -700^0 * 100^0 > 30000 * 100^0 < 36000 * 100^0 ^Subject: (Mail Delivery System|Hi|Hello|hello|Test|test|Status) * 100^0 ^X-Priority: 3 * 100^0 ^X-MSMail-Priority: Normal * 100^0 Content-Type: text/plain; * 100^0 charset="Windows-1252" * 100^0 Content-Type: multipart/mixed; * 100^0 ^The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment\. * 100^0 ^The message contains Unicode characters and has been sent as a binary attachment\. * 100^0 ^Mail transaction failed. Partial message is available\. # just test the zip extension as usual extensions get trapped by the # "dumb worms" rule * 100^0 name=".*\.zip" "${MAIL_DIR}/junk"Enjoy