"Timothy J. Luoma" <tjlists(_at_)bigfoot(_dot_)com> writes:
# First, check to see in the entire message is the virus/worm/etc
:0
* ^Content-[-a-z0-9_]+:.*=[ ]*"?[^"]*\.(vbs|bat|pif)
$MAILDIR/infected.mbx
# If the message is multipart, check the body
:0
* ^Content-Type:.*multipart
* B ?? ^Content-[-a-z0-9_]+:.*($[ ].*)*=[ ]*($[ ]+)*"?\
[^"]*\.(vb[se]|ws[fhe]|hta|shs|exe|pif|dll|scr)
$MAILDIR/infected.mbx
I've added some other nasty suffixes to the list.
but to only the second recipe... was that intentional?
That's a typo. They should be the same.
Is the format of the Body regex broken up necessarily or could you remove the \
after the ? and make it all one long line?
Um, as in all regexp conditions, the line continuation, together with
the leading whitespace on the next line, has no semantic value and may
be removed.
Philip Guenther
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail