procmail
[Top] [All Lists]

Re: Badtrans worm signature trap for local-rules.procmail

2001-11-26 11:54:18

# Trap BadTrans? (signature as of 11/26/2001)
#
:0
* > 40000
* < 50000
* ^Subject:.*Re:
* ^Content-Type:.*multipart/related;
* ^Content-Type:.*multipart/alternative; boundary="====_ABC0987654321DEF_===="

 All the ones I've caught so far have
 
   boundary="====_ABC1234567890DEF_===="

 They also have double quotes around multipart/alternative.

_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>