procmail
[Top] [All Lists]

Re: Blocking the Melissa Trojan

1999-03-31 11:05:24
++ 29.03.1999, 18:29:16 (-0800) = Jerry Preeper:
I was wondering if someone could help me figure out what I'm missing in
this recipe.  Basically, I'm just trying to send any email with the Melissa

You are not alone... hehehe. I have a problem as well.

Although i run Linux and i won't have any problems receiving Melissa, i
tried to set up a filter as well, just for the experience. Just to know
what i have to take note off when creating a filter...

I would like to have the following things. First it needs to filter out
possibly Melissa infected emails. It should be marked in the Log, then
there should be an auto-reply, and then it needs to be put in a special
filer. I have adapted the example that was posted here some time ago. Is
this a thing that would work? (I have had one test message, but that one
wasn't sent from Outlook, so maybe that's where it goes wrong). Any
other suggestions?

--begin
:0 H
* ^Subject:.*important Message From
{
  :0 Bc
  * Here is that document you asked for
  * don't show anyone else
  * ^Content-.*: .*\.do[ct]
  {
    LOG='REJECT Possible "Melissa" Microsoft Word macro worm:
'
    :0cf
    * ! ^X-Loop: auto-reply(_at_)sisterray(_dot_)xs4all(_dot_)nl
    | formail: -rtb -I"From: <auto-reply(_at_)sisterray(_dot_)xs4all(_dot_)nl>" 
\
               -I "X-Loop: <auto-reply(_at_)sisterray(_dot_)xs4all(_dot_)nl>" \
               cat $HOME/mail/send/melissa.txt \ | $SENDMAIL -oi -t


    :0:
    special-attn
  }
}
--end

Thanx, -Rejo.

-- 
= Rejo [Sister Ray Crisiscentrum]                 
rejo(_at_)sisterray(_dot_)xs4all(_dot_)nl
= http://mediaport.org/~sister             PGP: DSS B20D35F8, RSA FAE40065
= Please do not carbon me on list replies. I'll get my copy from the list.