Re: filtering sexyfun(_at_)hahah(_dot_)net

ProcMail Sample wrote:
> I'm a newbie to the list, how can I configure or filter
> those sexyfun email, I'm too much affected with this virus.
> I'm already updated my procmail to new version. Now the thing
> is where can I start. Pls. give me detailed instruction on
> how to do this one.
Here is a good procmail recipe that we use that filters out the snow
white virus (and many others) by catching their attachments:

<snip>

:0 hBHw
* ^Content-type: (multipart/mixed|application/octet-stream)
{
         :0B
         * .*creative\.exe
         /dev/null

         :0B
         * .*MPDLNOMP\.EXE
         /dev/null

         :0B
         * .*KDDKNHKD\.EXE
         /dev/null

         :0B
         * .*UNREGASF\.EXE
         /dev/null

         :0B
         * .*Navidad\.exe
         /dev/null

         :0B
         * .*\.(vbs|wsf|shs|scr)
         /dev/null

         :0B
         * .*dwarf4you\.exe
         /dev/null

         :0B
         * .*porno\.exe
         /dev/null

         :0B
         * .*joke\.exe
         /dev/null

         :0B
         * .*atchim\.exe
         /dev/null

         :0B
         * .*Emanuel\.exe
         /dev/null

         :0B
         * .*NakedWife\.exe
         /dev/null


</snip>

-- 
Chris

o----< ccook(_at_)tcworks(_dot_)net >------------------------------------o
|Chris Cook - Admin     |TCWORKS.NET - http://www.tcworks.net |
|The Computer Works ISP |FreeBSD - http://www.freebsd.org     |
o-------------------------------------------------------------o
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail