On Thu, 20 Sep 2001, Robert Dege wrote:
From all the posts, I was able to construct a working Attachment
filter. But I have 2 questions:
:0
* ^Content-Type: MULTIPART/MIXED
{
:0 B
*^Content-Disposition: (attachment|inline);
*filename=".*\.(bat|bif|exe|pif|com|vbs)"
VIRUS
}
Is this doing what you think it is ? ... To me, it reads:
Check for a line containing "^Content-Type: MULTIPART/MIXED"
If found, check for Body containing a "^Content-Disp" and also
containing certain suffixed file names.
It would not seem to elide JUST the attachment, but rather be
almost re-writable as:
:0HB
* ^Content-Type: MULTIPART/MIXED
* ^Content-Disposition: (attachment|inline);
* filename=".*\.(bat|bif|exe|pif|com|vbs)"
VIRUS
(Ignoring the 'B" stanza test localization within the braces)
... and this drops the whole message into the file 'VIRUS'.
But I am probably missing something ...
-- Russ Herrold
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail