At the risk of being totally off-topic, but hey, there must be more than one sysadmin in the audience using Postfix as an MTA...

I have a regex that looks for antivirus spew in order to reject it. Someone had collected a large list of subject headers received from antivirus malware and posted it to the Postfix mailing list. Rather than bog down my server with a check against each subject, I used Perl to build one regex to match them all (and in the darkness bind them :)

If your postfix installation was compiled with the pcre library, you can use the following:

/^(        filename="VIRUS_DETECTED_AND_REMOVED_|Subject:(?: (?:.*-Dan
+ger : Virus Trouvé|A(?:TENCION\. Usted ha enviado un mail posiblement
+e infectado|ntigen found FILE FILTER=|ttachment removed|viso de corre
+o\.universia\.net - Virus encontrado)|D(?:etecté Virus - Sujet :|isal
+lowed attachment type)|I(?:llegal attachment type found in sent messa
+ge|n(?:cidencia de virus|terScan NT Alert|valid content in mail messa
+ge \(message rejected\)))|MDaemon (?:Notification -- Attachment Remov
+ed|Warning - Virus Found)|N(?:AV detected a virus in a document you a
+uthored|OTIFICATION: Virus stopped|ie dostarczono poczty e-mail|orton
+ AntiVirus detected and quarantined a virus in a message yo)|Possible
+ Virus Found in E-Mail|Returned (?:due to virus; was:|mail: Possible 
+Virus Infection)|S(?:canMail Message: To Sender, virus found and acti
+on taken\.|kynet Mail Protection scan results|ymantec (?:AVF detected
+ a(?: repairable\/quarantined virus in a message you sent|n unrepaira
+ble virus in a message you sent)|Mail Security detected that you sent
+ a message containing an executable file\.))|T(?:ipo de archivo adjun
+to no permitido encontrado en el mensaje enviado|rovato virus nel mes
+saggio)|U(?:nsolicited commercial email rejected|waga: Wykryto wirusa
+ w poczcie)|V(?:IRUS (?:IN YOUR MAIL TO|NO SEU EMAIL !!!|RE:|VE VASI 
+ZPRAVE pro|\(W32\/Mydoom@MM\) IN MAIL FROM YOU)|irus(?: (?:Detected b
+y Network Associates, Inc\. Webshield SMTP|Infection Alert!|Warning|f
+ound in (?:message (?:\(quarantined\)|from you|to you!)|your message 
+Mail Transaction Failed)|in(?:cident|fection notice)|no seu email)|fe
+rtozesi ertesites|veszely! Virus warning!))|W(?: (?:Twojej wiadomosci
+ znaleziono wirusa! \/ Virus found in your message!|wiadomosci wyslan
+ej przez Ciebie wykryto WIRUSA)|ARNING: (?:The message contains a vir
+us!|YOU MAY HAVE A VIRUS)|IRUS (?:W TWOJEJE POCZCIE|w Twoim mailu !)|
+arning(?: Possible Virus Alert !!!|: antivirus system repor)|ykryto w
+irusa w Twoim mailu!:)|Your mail server sent us a virus|\(Virus\?\)|\
+[MailServer Notification\]To Sender virus found and action taken\.|\{
+Virus!\}|virus (?:alert|trovato in un messaggio inviato))|  Returned 
+due to virus; was:))/ REJECT antivirus pollution is not wanted here: 
+haven't you heard that viruses forge e-mail addresses?

[download]

Note: the above is senstitive to spaces. Make sure you "download code" rather than a simple cut'n'paste.

I've put the RE in a <readmore>, something I never do as a rule in a reply, but it occurs to me that if for people who have long line code wrapping turned off it will make the page rather... wide.

In any case, it's been weeks since we have been bothered by the antics of antivirus software.

In reply to Re:x4 OT: Well now a worm spreader! (postfix header check for virus spew) by grinder
in thread OT: Well now a worm spreader! by Marza

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.