From: Austin Ziegler Date: 2003-09-20T09:22:47+09:00 Subject: POP3Filter for SoBig.F Virus: This is a multipart message in MIME format --55472588-POCO-02258828 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Here's an updated version of the Ruby pop3filter that was written. This checks for the To: address, too, since that could be forged as well. Note that there's a bug in the original version that won't be noticed in most cases because FROM_RE and SUBJECT_RE are empty. This has been fixed. -austin -- austin ziegler * austin@halostatue.ca * Toronto, ON, Canada software designer * pragmatic programmer * 2003.09.19 * 20.16.39 --55472588-POCO-02258828 Content-Type: application/octet-stream; name="pop3filter.rb" Content-Transfer-Encoding: Base64 Content-Disposition: attachment; filename="pop3filter.rb" cmVxdWlyZSAnbmV0L3BvcCcNCg0KY2xhc3MgUE9QM0ZpbHRlcg0KICBkZWYgaW5pdGlhbGl6ZShz ZXJ2ZXIsIGxvZ2luLCBwYXNzd29yZCkNCiAgICBAc2VydmVyID0gc2VydmVyDQogICAgQGxvZ2lu ICA9IGxvZ2luDQogICAgQHBhc3N3ZCA9IHBhc3N3b3JkDQogIGVuZA0KDQogIENPTU1PTl9SRSAg PSBbICVye1xiTSg/OlN8aWNyb3NvZnQpXGJ9IF0NCiAgU1VCSkVDVF9SRSA9IFtdDQogIEZST01f UkUgICAgPSBbXQ0KICBUT19SRSAgICAgID0gW10NCg0KICBkZWYgY29tbW9uX21hdGNoKHIsIHMs IGYsIHQpDQogICAgZG9fbWF0Y2gociwgcykgb3IgZG9fbWF0Y2gociwgZikgb3IgZG9fbWF0Y2go ciwgdCkNCiAgZW5kDQoNCiAgZGVmIGRvX21hdGNoKHIsIHgpDQogICAgci5tYXRjaCh4KQ0KICBl bmQNCg0KICBkZWYgcHJvY2Vzcw0KICAgIGNvbm5lY3Rpb24gPSBOZXQ6OlBPUDMubmV3KEBzZXJ2 ZXIpDQogICAgY29ubmVjdGlvbi5zdGFydChAbG9naW4sIEBwYXNzd2QpIGRvIHxwb3B8DQogICAg ICBwdXRzICJcbkNvbm5lY3RlZCB0byAje0BzZXJ2ZXJ9LiINCiAgICAgIHB1dHMgIiN7cG9wLm1h aWxzLnNpemV9IG1lc3NhZ2Uocykgb24gc2VydmVyLiINCg0KICAgICAgc29iaWcgPSBbXQ0KICAg ICAgcG9wLmVhY2ggZG8gfG1haWx8DQogICAgICAgIHByaW50ICIuIg0KICAgICAgICBoZWFkZXIg ID0gbWFpbC5oZWFkZXINCiAgICAgICAgc3ViamVjdCA9IGhlYWRlci5ncmVwKC9eU3ViamVjdDov aSlbMF0uc3RyaXAuY2hvbXAuZ3N1YigvXlN1YmplY3Q6L2ksICcnKQ0KICAgICAgICBmcm9tICAg ID0gaGVhZGVyLmdyZXAoL15Gcm9tOi9pKVswXS5zdHJpcC5jaG9tcC5nc3ViKC9eRnJvbTovaSwg JycpDQogICAgICAgIHRvICAgICAgPSBoZWFkZXIuZ3JlcCgvXlRvOi9pKVswXS5zdHJpcC5jaG9t cC5nc3ViKC9eVG86L2ksICcnKQ0KDQogICAgICAgIGlmIG1haWwuc2l6ZSA+IDEyMF8wMDANCiAg ICAgICAgICBDT01NT05fUkUuZWFjaCBkbyB8cnwNCiAgICAgICAgICAgIGlmIGNvbW1vbl9tYXRj aChyLCBzdWJqZWN0LCBmcm9tLCB0bykNCiAgICAgICAgICAgICAgc29iaWcgPDwgeyA6c3ViamVj dCA9PiBzdWJqZWN0LCA6ZnJvbSA9PiBmcm9tLCA6bWFpbCA9PiBtYWlsIH0NCiAgICAgICAgICAg ICAgbmV4dA0KICAgICAgICAgICAgZW5kDQogICAgICAgICAgZW5kDQogICAgICAgICAgU1VCSkVD VF9SRS5lYWNoIGRvIHxyfA0KICAgICAgICAgICAgaWYgZG9fbWF0Y2gociwgc3ViamVjdCkNCiAg ICAgICAgICAgICAgc29iaWcgPDwgeyA6c3ViamVjdCA9PiBzdWJqZWN0LCA6ZnJvbSA9PiBmcm9t LCA6bWFpbCA9PiBtYWlsIH0NCiAgICAgICAgICAgICAgbmV4dA0KICAgICAgICAgICAgZW5kDQog ICAgICAgICAgZW5kDQogICAgICAgICAgRlJPTV9SRS5lYWNoIGRvIHxyfA0KICAgICAgICAgICAg aWYgZG9fbWF0Y2gociwgZnJvbSkNCiAgICAgICAgICAgICAgc29iaWcgPDwgeyA6c3ViamVjdCA9 PiBzdWJqZWN0LCA6ZnJvbSA9PiBmcm9tLCA6bWFpbCA9PiBtYWlsIH0NCiAgICAgICAgICAgICAg bmV4dA0KICAgICAgICAgICAgZW5kDQogICAgICAgICAgZW5kDQogICAgICAgICAgVE9fUkUuZWFj aCBkbyB8cnwNCiAgICAgICAgICAgIGlmIGRvX21hdGNoKHIsIHRvKQ0KICAgICAgICAgICAgICBz b2JpZyA8PCB7IDpzdWJqZWN0ID0+IHN1YmplY3QsIDpmcm9tID0+IGZyb20sIDptYWlsID0+IG1h aWwgfQ0KICAgICAgICAgICAgICBuZXh0DQogICAgICAgICAgICBlbmQNCiAgICAgICAgICBlbmQN CiAgICAgICAgZW5kDQogICAgICBlbmQNCiAgICAgIHB1dHMgIlxuIg0KDQogICAgICBicmVhayBp ZiBzb2JpZy5zaXplID09IDANCiAgICAgIHB1dHMgIkZvdW5kIHRoZSBmb2xsb3dpbmcgbWVzc2Fn ZXM6Ig0KICAgICAgc29iaWcuZWFjaCB7IHxtfCBwdXRzICIlLTM3LjM3cyAlLTM3LjM3cyIgJSBb bVs6c3ViamVjdF0sIG1bOmZyb21dXSB9DQogICAgICBhbnN3ZXIgPSBuaWwNCiAgICAgIGxvb3Ag ZG8NCiAgICAgICAgcHJpbnQgIlxuRGVsZXRlIGFsbCAje3NvYmlnLnNpemV9IG9mIHRoZW0/ICIN CiAgICAgICAgYW5zd2VyID0gJHN0ZGluLmdldHMuY2hvbXAuZG93bmNhc2UNCiAgICAgICAgYnJl YWsgaWYgWyd5JywgJ24nXS5pbmNsdWRlPyhhbnN3ZXIpDQogICAgICBlbmQNCg0KICAgICAgaWYg YW5zd2VyID09ICd5Jw0KICAgICAgICBzb2JpZy5lYWNoIHsgfG18IG1bOm1haWxdLmRlbGV0ZSBh bmQgcHJpbnQgIi4iIH0NCiAgICAgIGVsc2UNCiAgICAgICAgc29iaWcuZWFjaCBkbyB8bXwNCiAg ICAgICAgICBwdXRzICIlLTM3LjM3cyAlLTM3LjM3cyIgJSBbbVs6c3ViamVjdF0sIG1bOmZyb21d XQ0KICAgICAgICAgIGxvb3AgZG8NCiAgICAgICAgICAgIHByaW50ICJcbkRlbGV0ZSBTb0JpZy5G PyAiDQogICAgICAgICAgICBhbnN3ZXIgPSAkc3RkaW4uZ2V0cy5jaG9tcC5kb3duY2FzZQ0KICAg ICAgICAgICAgYnJlYWsgaWYgWyd5JywgJ24nXS5pbmNsdWRlPyhhbnN3ZXIpDQogICAgICAgICAg ZW5kDQogICAgICAgICAgbVs6bWFpbF0uZGVsZXRlIGlmIGFuc3dlciA9PSAneScNCiAgICAgICAg ZW5kDQogICAgICBlbmQNCiAgICBlbmQNCiAgZW5kDQplbmQNCg0KUE9QM0ZpbHRlci5uZXcoInNl cnZlciIsICJ1c2VyIiwgInBhc3N3b3JkIikucHJvY2Vzcw0K --55472588-POCO-02258828--