Subject: Virus filter

From: David Hamm <[email-masked]>
Date: Mon, 9 Oct 2000 15:12:34 -0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

I'm running smap & smapd and am plagued with a number of email viruses on WinX
clients.  Has anyone done any work on  developing email filters that would
remove or disarm viruses.

 ---------------------------------
David Hamm
Systems Analyst
Imaging Technologies Services Inc.
email: [email-masked]
voice: 404-870-6663
---------------------------------

---

From: Ted Keller <[email-masked]>
Date: Mon, 9 Oct 2000 19:33:57 -0400 (EDT)

David,

I may have a partial fix...  My spam filters can be used to remove simple
viruses that have signitures in the subject, header, or text lines.  There
is also a sendmail add-on which was reported on bugtraq for removing
specific type of attachments from e-mail messages.  This could be used for
removing any .exe and the like.

Beyond that,  you may need to go into a commercial virus product for
further e-mail cleansing.

ted keller

---

From: "Tom Krotchko" <[email-masked]>
Date: Mon, 9 Oct 2000 21:54:17 -0400

Someone posted some perl scripts they had written for this task.

Crude, but very effective.  You've got to know what you're doing
to set them up (understand the basics of RE's, perl, and the
startup scripts on your firewall), and it basically won't deliver any
message with forbidden strings.

I'm at home, and i can't remember the name...something like
smapwatch?  Check the archives for the source.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On
Behalf Of David Hamm
Sent: Monday, October 09, 2000 3:13 PM
To: [email-masked]
Subject: Virus filter

[To be removed from this list send the message "unsubscribe fwtk-users" in
the
BODY of a mail message to [email-masked].]

I'm running smap & smapd and am plagued with a number of email viruses on
WinX
clients.  Has anyone done any work on  developing email filters that would
remove or disarm viruses.

---

From: Jan Muenther <[email-masked]>
Date: Tue, 10 Oct 2000 09:19:12 +0200

> remove or disarm viruses.

Check out AMaViS at http://www.amavis.org  - we use it and it
performs quite nicely. 
Cheers, Jan
-- 
Radio HUNDERT,6 Medien GmbH Berlin
- EDV -
[email-masked]

---

From: "Shawn Fletcher" <[email-masked]>
Date: Tue, 10 Oct 2000 10:58:12 +0200

I used AmaVis to do this with sendmail.  It works with most of the
unix/linux anti virus scanners.  Unfortuanately it only cleanses incoming
mail.

I use F-Prot to check for virii

I wrote a dirty little script to do this on the firewall.  Assuming that
smap/smapd use different directories its as follows.  (My shell scripting
etc is putrid but you should get the idea anyway.  The Amavis has better
ways of unziping and protection on unziped files.  This definately puts more
overhead on the firewall)

I call this script every 1 minute with sleep 60.

Cut Here
########################################################
#!/bin/bash
########################################################
#mail virus scanning       #
########################################################
SMAPDIR=/var/spool/smap
SMAPDDIR=/var/spool/smapd
HOLDINGPOINT=/var/spool/virus
SENDMAIL=/usr/sbin/sendmail
MM_QUIET=1
MM_SUMMERY="To:"
export METAMAIL_TMPDIR="/tmp/metamail"

CHECKVIR()

{
    VIRFOUND=0

   /usr/local/fsav/fsav --databasedirectory=/usr/local/fsav --dumb --archive
/tmp/metamail/* > /tmp/virus.log
    SCANMAIL=$?
    if test $SCANMAIL -eq 3
 then
     VIRFOUND=1
 fi
    rm -f /tmp/metamail/*

}

NOTIFY()
{
 zip -jklov9 $HOLDINGPOINT/$MESSAGE.zip.renameme $HOLDINGPOINT/$MESSAGE
 receipent=`cat $HOLDINGPOINT/$MESSAGE.headers | grep -s ^To: | sed
's/To://;s/ *//g;s/,/,,,/g;s/,/& =/g;s/,,/ /g'| tr "=" "\n" | sed 's/^/&
=/g' | tr "=" "\t" |  grep okfd.com `
 sender_=`grep 'From:' $HOLDINGPOINT/$MESSAGE.headers | sed '2d;s/From://g'`
 sender=`echo $sender_ | sed -e 's/^/:/;s/ </: </g'`
 sender_address=`echo $sender | sed 's/ </</;s/ /_/g' | tr ":" "'" `
 VIRTYPE=`grep 'infection:' $HOLDINGPOINT/$MESSAGE.virus | sed -e
's/\/tmp\/metamail\///;s/infection://' | awk '{print $2}'`
 FILENAME=`grep 'infection:' $HOLDINGPOINT/$MESSAGE.virus | sed -e
's/\/tmp\/metamail\///;s/infection://' | awk '{print $1}'`

cat <<EOF| mutt -s "VIRUS IN A MAIL MESSAGE FROM $sender_ to YOU" $receipent

             V I R U S  A L E R T

 The Mailserver found a
 virus called $VIRTYPE in attachement $FILENAME
 From $sender_ addressed to You.

 The Delivery of this email was stopped.

 The Sender $sender_ was notified of the failure.

 If the sender of this E-mail is known to you, please
 contact them and ask them to resend the message without
 the virus attached.
EOF

cat <<EOF| mutt -s "VIRUS IN A MAIL MESSAGE FROM $sender_"
[email-masked] -a /var/spool/virus/$MESSAGE.zip.renameme

             V I R U S  A L E R T

 The Mailserver found a
 virus called $VIRTYPE in attachement $FILENAME
 addressed to :

$receipent

 The Delivery of this email was stopped.
EOF

cat <<EOF| mutt -s "VIRUS IN A MAIL MESSAGE FROM $sender_ "
"$sender_address" -a /var/spool/virus/$MESSAGE.zip.renameme

             V I R U S  A L E R T

 The Mailserver found a
 virus called $VIRTYPE in attachement $FILENAME
 addressed to :

$receipent

 The Delivery of this email was stopped.

 The Recipients have been notified that your e-mail was stopped

 Now it is up to you to check your system for viruses.

 The offending mail message has been attached for you convenience.
 The message has been zipped and then stripped of the .zip extension
 so that no other Virus scanners will attempt to open it.

 If you feel that this message is incorrect mail [email-masked]
 and the matter will be looked into.

 check out : http://www.gas.co.za

 The email was checked using F-Prot for Linux.

EOF

}

MAILCONT()
{
if test $VIRFOUND -eq 1
    then
 mv $SMAPDIR/$MESSAGE $HOLDINGPOINT/$MESSAGE
 cp /tmp/headers $HOLDINGPOINT/$MESSAGE.headers
 cp /tmp/virus.log $HOLDINGPOINT/$MESSAGE.virus
 NOTIFY
    else
 mv $SMAPDIR/$MESSAGE $SMAPDDIR/$MESSAGE
fi
}

GETTO()

{
metamail -x -r -w $SMAPDIR/$MESSAGE > /tmp/headers

}

main()
{

for MESSAGE in `ls -l $SMAPDIR | awk '{print $9}' | grep sma`
    do

 GETTO
 CHECKVIR
 MAILCONT
    done

}

main

###########################################################
cut here

----- Original Message -----
From: David Hamm <[email-masked]>
To: <[email-masked]>
Sent: Monday, October 09, 2000 9:12 PM
Subject: Virus filter

the
WinX