On Fri, 27 Jun 2003, Dragoncrest wrote:
D> The new emails that are getting through contain an attachment with
D> either the extension "zi" or "zi " (zi with a space after it) Can
D> anyone suggest an adjustment/addition to this recipe that might block
D> these type of attachments too? Thanks.
D>
zi( )?
Alternatively, hack a line almost at random and filter using that. I say
almost at random as you need to avoid lines containing stuff such as * \
etc. So not really randon at all.
I have included XXXXXX in the recipe below so that my filter won't catch
this message.
## Another Sobig
# take a random line from the attachment
:0 B :
*
^blobZesPQ7WBsXXXXXXQSmYwX9cPJx4fOtlQXrp5RRttjGwbM3Qayq4RppniBKnkBHjAJz7KCA5AURYhAY$
IN.zzzz.viruses
Alan
( Please do not email me AS WELL as replying to the list. Please
address personal email to alan+1@ as lists@ is not read. A
password autoresponder may be invoked if this email is very old. )
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail