procmail
[Top] [All Lists]

Re: Blocking the Melissa Trojan

1999-03-29 19:42:44
Hello all.

I was wondering if someone could help me figure out what I'm missing in
this recipe.  Basically, I'm just trying to send any email with the Melissa
virus to a special spam box I have set up with no logging.  I copied the
recipe from example, then took out the logging (since I use a special
mailbox).   

I get the following message in the log file:

procmail: Extraneous filter-flag ignored

When I remove this recipe, I don't get any error messages.  

Here is the recipe

:0 f
* ^Subject:.*important Message From
{
  :0B
  * Here is that document you asked for
  * don't show anyone else
  * ^Content-.*: .*\.do[ct]
  }
|formail -A "X-Spam-Reject: rc.viruses - Melissa Word"

:0
* ^X-Spam-Reject:
/var/mail/spam



Jerry




Per Aleph1:
The subject line is "important Message From <some user name>". The
body consist of the text "Here is that document you asked for...
don't show anyone else;-)".

That's fairly simple...

:0 H
* ^Subject:.*important Message From
{
 :0 B
 * Here is that document you asked for
 * don't show anyone else
 * ^Content-.*: .*\.do[ct]
 {
   LOG='REJECT Possible "Melissa" Microsoft Word macro worm: '
 
   :0
   security-quarantine
 }
} 

--
John Hardin KA7OHZ                               
jhardin(_at_)wolfenet(_dot_)com
pgpk -a finger://gonzo.wolfenet.com/jhardin    PGP key ID: 0x41EA94F5
PGP key fingerprint: A3 0C 5B C2 EF 0D 2C E5  E9 BF C8 33 A7 A9 CE 76 
-----------------------------------------------------------------------
 In the Lion
 the Mighty Lion
 the Zebra sleeps tonight...
 Dee de-ee-ee-ee-ee de de de we um umma way!
-----------------------------------------------------------------------
  52 days until Star Wars episode I