On Wed, 20 Aug 2003, Bart Schaefer wrote:
BS> We're now /dev/null-ing our flood of Sobig.F's, but we're still getting a
BS> lot of silly "you may be infected" auto-responses (of course, we're not
BS> infected, the worm is forging the sender address, as a simple rDNS on
BS> the sending IP would demonstrate).
BS>
BS> Does anyone happen to already have a set of recipes to catch these?
BS> Sent by Declude, NAV for Exchange, RAV, etc. etc. ...
BS>
BS>
My recipes send them to one of 3 places.
If they are identifiable as a daemon, they are shunted into the daemon
box.
If they include the virus, they get put in the virus box. Please tell me,
what lunatic would write virus protection software that identifies a
virus and then sends out that virus in an email.
If not, they hit the autoresponder.
Alan
( Please do not email me AS WELL as replying to the list. Please
address personal email to alan+1@ as lists@ is not read. A
password autoresponder may be invoked if this email is very old. )
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail