procmail
[Top] [All Lists]

Re: (procmail) happy.exe

1999-03-05 11:25:38
Hermann Wecke wrote:

<> Does someone has a "magic solution" to avoid the happy.exe trojan virus
<> being propagated via mailing list???

The happy99.exe worm seems to use UUencoding, so it's pretty easy to
catch.

For procmail, try:

  :0 B
  * ^begin[      ]+[a-z]+[       ]+[0-9]+
  $UU-TRAP

if you're running MajorDomo, add the following to taboo_body:

  taboo_body          <<  END
  /^begin\s+\w*\s+\d\d\d/i
  END

I +love+ perl regex ... 

Reto
-- 
R A Lichtensteiger       rali(_at_)meitca(_dot_)com -or- 
rali(_at_)world(_dot_)std(_dot_)com
                         http://www.meitca.com/ITA/People/rali
    "Yes, you're doing things right, but are you doing the right things?"
    "Nope.  I'm just doing something dumb fast."

<Prev in Thread] Current Thread [Next in Thread>