procmail is your friend
# thanks to Sematimba Noah K <ksemat(_at_)wawa(_dot_)eahd(_dot_)or(_dot_)ug>
:
*^Content-type: (multipart/mixed|application/octet-stream)
{
:0 HB
*^Content-Disposition:
attachment;.*filename=".*\.(bat|com|exe|vbs|chm|hlp|shs|wsf|vbe|wsh|hta|pif)"
{
:0 fhbw
|/usr/bin/sed -e 's/\([nN][aA][mM][eE]=".*\....\)"/\1.txt"/'
:0 c
/dev/null
}
}
#
# thanks to <oops! rob or patrik or ....?>
:
* ^Subject:.*(Virus Alert$|Virus Notification: A virus has been
detected|Antivirus Utility found the|Antigen found.*virus|Attachment Stripped
in Transaction|ScanMail Message: To Recipient virus found and action
taken.|Report to Recipient|Suspicious email message intercepted)
/dev/null