# First, check to see in the entire message is the virus/worm/etc
:0
* ^Content-[-a-z0-9_]+:.*=[ ]*"?[^"]*\.(vbs|bat|pif)
$MAILDIR/infected.mbx
# If the message is multipart, check the body
:0
* ^Content-Type:.*multipart
* B ?? ^Content-[-a-z0-9_]+:.*($[ ].*)*=[ ]*($[ ]+)*"?\
[^"]*\.(vb[se]|ws[fhe]|hta|shs|exe|pif|dll|scr)
$MAILDIR/infected.mbx
I've added some other nasty suffixes to the list.
but to only the second recipe... was that intentional?
Is the format of the Body regex broken up necessarily or could you remove the \
after the ? and make it all one long line?
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail