On Tue, 24 Jul 2001, i l i a n a f i l b y wrote:
I poked at Don Hammond's sugguestion and came up with the following.
Comments & suggestions are very welcome.
############################################################
# SirCam protection
:0 H
* ! ^X-BeenThere: procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
* B ?? Hi\! How are you\?
* B ?? I send you this file in order to have your advice
* B ?? See you later. Thanks
* B ?? Hola como estas *\?
* B ?? Te mando este archivo para que me des tu punto de vista
* B ?? Nos vemos pronto, gracias\.
* B ?? Hi\! How are you\?
* 1^0 B ?? I send you this file in order to have your advice
* 1^0 B ?? I hope you like the file that I send( t)?o you
* 1^0 B ?? This is the file with the information that you ask for
* B ?? See you later. Thanks
{
LOG='REJECT - SirCam'
:0
/var/tmp/SirCam-quarantine
}
###########################################################
I also added a check to verify the attachment existed. Some of my users
are sending around full blown HTML versions of the mcafee/norton pages
giving details on the virus. These contain the body as the virus within
the page, and I see no reason to hinder the imparting of clues, even if it
is HTML infested.
* ^Content-Type:.*(multipart|attachment)
--
Kip Turk spamdies(_at_)wcc(_dot_)net
Systems Administrator/Killer of Spam/Writer of Code/Penguin Proponent
West Central Net - tel: 915.234.5678 / 800.695.9016 fax: 915.656.0071
-.-. --- -.. . / -- --- -. -.- . -.-- --..-- / .... .- -.-. -.- . .-.
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail