procmail
[Top] [All Lists]

Re: IL0VEY0U has mutated

2000-05-04 16:32:18
No, because the filename only appears in the attachment header.  Since this
is a multipart message, those are in the body of the message.  I've been
using the following recipe:

   :0
   * 9876543210^0      ^Content-[-a-z0-9_]+:.*="?[^"]*\.vbs
   * 9876543210^0 B ?? ^Content-[-a-z0-9_]+:.*($[      ].*)*="?[^"]*\.vbs
   $BOG/vbs/$DEST

Just as an FYI for everyone, there's no guarantee that these will
come as attachements.  We caught several that uuencoded the message
body instead:

   kindly check the attached LOVELETTER coming from me.


   begin 600 LOVE-LETTER-FOR-YOU.TXT.vbs
   M<F5M("!B87)O:R`M;&]V96QE='1E<BAV8F4I(#QI(&AA=&4(_at_)9V\@=&\@<V-H
   ...

Chris

<Prev in Thread] Current Thread [Next in Thread>