Re: Konfigurasi amavisd-new untuk virus dengan fake sender

On Tue, 4 May 2004 09:01:39 +0700
Asfihani <asfik-yNEVPA1OLJZWk0Htik3J/[email protected]> wrote:

> Halo,
> 
> Berhubung semakin banyaknya virus yang menggunakan sender plasu (fake
> sender), maka jika anda menggunakan Postfix dan amavisd-new sebagai
> content filtering, serta menggunakan Clam AV sebagai Anti Virusnya,
> silakan dilihat kembali konfigurasi di amavisd.conf anda.
> 
> Default amavisd.conf adalah :
> 
> $viruses_that_fake_sender_re = new_RE(
>   qr'nimda|hybris|klez|bugbear|yaha|braid|sobig|fizzer|palyh|peido|holar'i
> );
> 
> Silakan ditambahkan string-string berikut: mimail,sco,mydoom,worm
> misalnya menjadi:
> 
> $viruses_that_fake_sender_re = new_RE(
>   qr'nimda|hybris|klez|bugbear|yaha|braid|sobig|fizzer|palyh|peido|holar|mimail|sco|mydoom|worm'i
> );

ini kira kira cukup nggak yah ?


$viruses_that_fake_sender_re = new_RE(
  qr'nimda|hybris|klez|bugbear|yaha|braid|sobig|fizzer|palyh|peido|holar'i,
  qr'tanatos|lentin|bridex|mimail|trojan\.dropper|dumaru|parite|spaces'i,
  qr'dloader|galil|gibe|swen|netwatch|bics|sbrowse|sober|rox|val(hal)?la'i,
  qr'frethem|sircam|be?agle|tanx|mydoom|novarg|shimg|netsky|somefool|moodown'i,
  qr'@mm|@MM',    # mass mailing viruses as labeled by f-prot and uvscan
  qr'Worm'i,      # worms as labeled by ~ClamAV, Kaspersky, etc
  [qr'^(EICAR|Joke\.|Junk\.)'i         => 0],
  [qr'^(WM97|OF97|W95/CIH-|JS/Fort)'i  => 0],
  [qr/.*/ => 1],  # true by default  (remove or comment-out if undesired)
);