procmail
[Top] [All Lists]

Re: Blocking the Melissa Trojan

1999-04-02 12:37:32
++ 31.03.1999, 22:18:24 (+0300) = era eriksson:
representative, and I found it in Deja News so it's kind of mangled)
you could make the check case sensitive (add a D flag) and use the
exact phrase ^Subject: Important Message From

Yes. I have been thinking of that as well. But almost never i get
messages saying 'important message from ...' and if i get them they're
almost always virusses or spams. :-)

So i guess there's no need to have the condition case-sensitive.

   * ^Content-(Type|Disposition):((.*)($[     ]))*\.do[ct]\>

I have had received only one email with the virus so far, but i'm unable
to find it right now. John told me in pm i could use    

        * name=.*\.do[ct] 

because of the wrapping...

Ouch. If you want f, you don't want c, and vice versa.

Really stupid, these syntax mistakes and all... And this f and c, i have
read at several places and several times, and i still used them both.
Stupid.

This will prepend the contents of melissa.txt after the headers (but
before the body; I imagine this is what you want) and then forward the

No, not exactly. Melissa.txt should be the body. But as i'm not using
the -k variable for formail the orginal body would be left away anyway.
Or am i missing here some important points?

Thanx for your help. I have put the various things in my procmailrc and
changed some other things (the order of the various actions -as you
mentioned) and i'll test the thing tomorrow.

        -Rejo.

-- 
= Rejo [Sister Ray Crisiscentrum]                 
rejo(_at_)sisterray(_dot_)xs4all(_dot_)nl
= http://mediaport.org/~sister             PGP: DSS B20D35F8, RSA FAE40065
= Please do not carbon me on list replies. I'll get my copy from the list.


<Prev in Thread] Current Thread [Next in Thread>