Untitled Documentthis is part of my procmailrc:
INCLUDERC=/etc/procmail/local-rules.procmail
INCLUDERC=/etc/procmail/html-trap.procmail
in local-rules.procmail , i put this filter:
# Trap Klez (signature as of 04/26/2002)
#
:0
* > 100000
* ^Content-Type:.*multipart/alternative;
{
:0 B hfi
* \<i?frame +src=(3D)?cid:.* height=(3D)?[0-9] +width=(3D)?[0-9]>
* ^Content-Type:.*audio/
* ^Content-ID:.*<
* ^Content-Transfer-Encoding: base64
* ^TVqQAAMAAAAEAAAA
| formail -A "X-Content-Security: [$HOST] NOTIFY" \
-A "X-Content-Security: [$HOST] QUARANTINE" \
-A "X-Content-Security: [$HOST] REPORT: Trapped possible Klez
worm - see
http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.tool.html";
}
when i send a test mail , show this log:
"rocmail: Skipped "
"rocmail: Skipped "
"rocmail: Skipped "
"rocmail: Skipped "-A "X-Content-Security: [$HOST] QUARANTINE" \
procmail: Skipped "-A "X-Content-Security: [$HOST] REPORT: Trapped possible
Klez worm - see
http://securityresponse.symantec.com/avc"nter/venc/data/w32.klez.removal.tool.html";
procmail: Closing brace unexpected
_________________________________________________________
Afeng Sun
QQ: 2016738 ICQ: 83104198
( Work Tel#: +8610 85830508
+ Email Box: afeng(_at_)top147(_dot_)com
_________________________________________________________