On Thu, May 04, 2000 at 02:14:07PM +0100, David Lee wrote:
For sendmail 8.9-ish, based on the Melissa virus last year, I have just
cobbled together the following, to trap the "ILOVEYOU" subject line (so we
need to be careful about our own "Subject:" when discussing this!)
HSubject: $>Check_Subject
<... you may already have Melissa lines here ...>
D{ILYPat}ILOVEYOU
D{ILYMsg}This message may contain the ILOVEYOU virus.
SCheck_Subject
<... you may already have Melissa lines here ...>
R$* ${ILYPat} $* $#error $: 553 ${ILYMsg}
I make no claims that it is anywhere near optimal, but it has trapped
about 6 messages in the last 20 minutes. (No idea how many of those were
"false positives".) Absolutely no warranties on it: own-risk etc. ...
I realize this is sendmail and not procmail, but can you give a quick rundown
of how this works, for those of us who don't grok sendmail rulesets?
And is there a way to have this deliver the message somewhere (so it can be
archived) instead of just dropping it?
--
Andrew Edelstein http://andrew.pure-chaos.com
Don't hold back. Tell us how you really feel. <G>
Cian, 17 Apr 2000