Imail 过滤 Mydoom/Novarg方法

钉子

随着Mydoom/Novarg危害的升级,Ipswitch于昨日(02/02/04) 发布了"IMail - How to protect against the Novarg.A virus"为题的KB,请大家注意,原文全文如下:<br>
<br>
-------------------------------------------------------------------------------<br>
IMail - How to protect against the Novarg.A virus <br>
Product: Version: Platform: <br>
IMail All NT,Win2000,XP,Win2003 <br>
<br>
--------------------------------------------------------------------------------<br><br>
Question/Problem: How do I protect against the Novarg.A virus?<br>
<br>
Answer/Solution: You will want Rules to block attachments. You want to make sure your anti-virus scanner has up to date virus definitions.<br>
<br>
Blocking attachments<br>
<br>
THESE STEPS SHOULD BLOCK ALL FILE ATTACHMENTS.<br>
**YOU WILL WANT TO CREATE RULES TO LOOK AT BOTH THE HEADER AND BODY OF MESSAGES.**<br>
<br>
1. Click on the hostname in IMail Administrator and select the Inbound Rules tab.<br>
2. Click Add<br>
3. From the dropdown box, select "If the Body text". You will also want to create the same rules to say "If the Header text".<br>
4. In the text box, paste the following: name=.*\.scr<br>
5. Click Add Condition<br>
6. Click insert OR<br>
7. In the text box, paste the following: name=.*\.pif<br>
8. Click Add Condition<br>
9. Click insert OR<br>
10. In the text box, paste the following: name=.*\.exe<br>
11. Click Add Condition<br>
12. Click insert OR<br>
13. In the text box, paste the following: name=.*\.zip<br>
14. Click Add Condition<br>
15. Click insert OR<br>
16. In the text box, paste the following: name=.*\.bat<br>
17. Click Add Condition<br>
18. Select the action to be taken.<br>
<br>
For more information on Rules creation see:<br>
IMail - Rules to filter all file attachments<br>
<br>
Use Current Virus Definitions<br>
Verify that your IMail Anti-Virus (or any desktop anti-virus scanner) has the current definitions. They should not be older than 1/28/2004.<br>
<br>
See also:<br>
IMail Anti-Virus - How to automatically update the Virus Definition File<br>
<br>
Disable User Notifications<br>
To stop the influx of notifications being sent to the users and administrator you should add an Inbound Rule to block "Virus Caught" notifications.<br>
<br>
1. Click on the hostname in IMail Administrator and select the Inbound Rules tab.<br>
2. Click Add<br>
3. From the dropdown menu select "If the Subject text"<br>
4. In the text box, enter Virus Detected<br>
5. Click Add Condition<br>
6. Click Insert And<br>
7. From the dropdown menu select "if the Body text" 8. In the text box, enter novarg<br>
8. Click Add Condition<br>
9. Click OK<br>
10. Select the action to be taken.<br>
<br>
Additional Information on Novarg.A<br>
<br>
<a target=_blank href=http://securityresponse.symantec.com/avcenter/venc/data/w32.novarg.a@mm.html>http://securityresponse.symantec.com/avcenter/venc/data/w32.novarg.a@mm.html</a><br>
<br>
<br>
--------------------------------------------------------------------------------<br>
<br>
A customer suggests: as there is a strain of the novarg virus which forwards itself, but fails to attach itself as a virus. You can add the following line to rules.ima to delete these annoying virus-created spam messages as they come in:<br>
<br>
S~(test|\shi\s|hello|Mail Delivery System|Mail Transaction Failed|Server Report|Status|Error):NUL<br><br>
Document #: Revision Date: <br>
IM-20040130-DM01 02/02/04 <br>
<br>
--------------------------------------------------------------------------------<br><br>
<a target=_blank href=http://support.ipswitch.com/kb/IM-20040130-DM01.htm>http://support.ipswitch.com/kb/IM-20040130-DM01.htm</a>

badwrs2000

FYI： badwrs2000 的过滤规则：<br>
<br>
<br>
短语过滤<br>
represented in 7-bit ASCII encoding and has <br>
Partial message is available<br>
contains Unicode characters and has been<br>
<br>
规则过滤<br>
<br>
B~(name="document.zip"|name="readme.zip"|name="doc.zip"|name="text.zip"|name="file.zip"|name="data.zip"|name="test.zip"|name="message.zip"|name="body.zip"):NUL<br>
<br>
B~(name=.*\.exe|name=.*\.scr|name=.*\.vbs|name=.*\.shs|name=.*\.cmd|name=.*\.bat|name=.*\.pif):NUL

flyingboy99

顶<br>

englishunix

thank you!<br>
如果有IMail Anti-Virus的注册文件那就更好了,谁有呀?<br>
请发一份给我.急!<br>
my E-mai:tjr2000@21cn.coml

钉子

以下是转自Dev-Club的帖子<br>
======================<br>
操作系统：win2000 adserver&sp4<br>
Imail8.05 & HF1<br>
原来是6.06版本，针对sobig和mydoom设置了附件过滤规则，不成功。升级到8.05，研读了ipswitch官方的资料。设置了outboud和inbound的针对附件类型进行邮件过滤得规则，试验成功。过程如下：<br>
展开 imail administrator<br>
展开localhost，任意选择一个主机，选择“Inbound rules”，add一个new rule，进行设置，select rule处选择“if the body text”，然后再search text框内输入：<br>
name=.*\.scr<br>
点“Add condition”，即便加入到Final rule框内，然后点“Insert Or”，将Or条件加在下边，然后回到search text框内，重新输入name=.*\.exe后，在add condition，在点"insert or“。依次将下边这些全都Or进去：<br>
name=.*\.bat<br>
name=.*\.com<br>
name=.*\.pif<br>
name=.*\.vbs<br>
name=.*\.shs<br>
name=.*\.sys<br>
name="doc.zip"<br>
name="document.zip"<br>
name="test.zip"<br>
name="readme.zip"<br>
name="your_detailes.zip"<br>
name="file.zip"<br>
name="data.zip"<br>
name=".zip"<br>
<br>
完了之后点ok，回到前一个页面，最下边你可选择针对有这样附件内容的邮件的动作是什末，我选的是“delete"你也可以move或者forward到其他的信箱里去，不过不建议这样做，否则一会这个邮箱就爆了。<br>
<br>
最后应用这个规则,同理你可以将这个设置添加在"outbound rules"上，这样进出的邮件对以上附件的邮件进行了过滤，动作是直接删除。<br>
然后到Imail安装目录下，找到这个主机的根目录，找到rules.ima和orules.ima这两个文件，分别是刚才设置的这个主机上的inbound和outbound的过滤规则。你可以将它们复制到其他的主机目录下，这样其他的主机也有了相同的过滤规则了！<br>
<br>
请大家指正或者有更为简单的过滤垃圾邮件的方法。<br>

梦中的风

楼上的需要什么日志?<br>
规则是钉子上面贴出来的<br>
连接进来的纪录就是<br>
被inbound屏蔽掉了<br>
难道他的信纸有病毒<br>
不解<br>
客户不用信纸直接用TXT的文件形式可以给我发邮件<br>
但是用了html的信纸 我铁定收不到<br>
为什么???<br>
他说他用最新的病毒库查过了 他机子没病毒<br>

梦中的风

钉子<br>
我做了这些后 有客户反映收发都不正常<br>
<br>
我在关注中<br>
你们有这样的事情发生吗

badwrs2000

都不正常???<br>
<br>
具体一点！

梦中的风

我的一个客户居然不能用信纸<br>
用信纸发信就被服务器拒绝掉了<br>
郁闷啊 不知道为什么<br>
还有客户收不到对方发来的邮件<br>
<br>

badwrs2000

第8楼的朋友，<br>
<br>
1 我的一个客户居然不能用信纸，用信纸发信就被服务器拒绝掉了 <br>
用什么客户端？什么错误提示，对应的你的smtp的日志如何记录？<br>
<br>
2 还有客户收不到对方发来的邮件<br>
是form什么地址？对方的smtp有没有连接你smtp的记录，你的antispam有没有误过滤？域规则或者用户规则有没有动作？