I have the following recipe for filtering a new worm that has been found
called vbs.freelink - similar to melissa. Just seeking input to see if it
looks correct
:0B f
* ^Subject:.*Check this
{
:0B f
* Have fun with these links
* ^Content-.*: .*\.vbs
|formail -A "X-Spam-Reject: rc.viruses - vbs.freelink"
}
anything with a X-Spam-Reject header gets filtered to a special mail
account for later review.
Info on the worm can be found here:
http://www.securityfocus.com/templates/archive.pike?list=1&date=1999-10-15&m
sg=19991020095332(_dot_)D14849(_at_)securityfocus(_dot_)com
Jerry