At 09:50 AM 3/28/99 -0700, Brett Glass wrote:
At 08:12 PM 3/27/99 -0800, John D. Hardin wrote:
[snip]
That's fairly simple...
:0 H
* ^Subject:.*important Message From
{
:0 B
* Here is that document you asked for
* don't show anyone else
* ^Content-.*: .*\.do[ct]
{
LOG='REJECT Possible "Melissa" Microsoft Word macro worm: '
If this logging ends up looking ugly, add a newline yourself:
LOG='REJECT Possible "Melissa" Microsoft Word macro worm:
'
(note close quote on the following line).
:0
security-quarantine
}
}
Almost right. The only thing is that we need to get the text just right
(at least if the matching is sensitive to case).
You must be coming from the non-procmail list (either it's open or this will
bounce from it, I guess)... procmail matches are case-insensitive by default.
You can get case-sensitive matches by adding a D flag on the :0 line.
The header begins
with "Important Message From" or "Re: Important Message From" -- capitalized
just so.
Could this be added to the standard set of filters as well?
What "standard set of filters?"
Cheers,
Stan