linux303 wrote:
Because the Sobig.F Worm is about 72K in size, would this work?
:0 B
* > 73000
* < 75000
* [.pif|.scr]
/var/log/quarantine
Sobig.F has some special characteristics which you should check also:
:0 BH
* ^X-MailScanner: Found to be clean
* ^X-Mailer: Microsoft Outlook
* filename="[a-z0-9]\.pif"
--
Klaus Johannes Rusch
KlausRusch(_at_)atmedia(_dot_)net
http://www.atmedia.net/KlausRusch/
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail