At 02:04 PM 8/19/2003 -0600, linux303 wrote:
All,
Because the Sobig.F Worm is about 72K in size, would this work?
:0 B
* > 73000
* < 75000
* [.pif|.scr]
/var/log/quarantine
Rather than attempt to deal with viruses individually, we block all
executable attachements based on file extensions and write them to a
"base64-virus.in" file for review.
:0 B
* (name[=:; ]+.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[
]*.*[ ]*\.bat|\
name[=:; ]+.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[
]*.*[ ]*\.com|\
name[=:; ]+.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[
]*.*[ ]*\.dll|\
name[=:; ]+.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[
]*.*[ ]*\.exe|\
name[=:; ]+.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[
]*.*[ ]*\.hta|\
name[=:; ]+.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[
]*.*[ ]*\.htm|\
name[=:; ]+.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[
]*.*[ ]*\.html|\
name[=:; ]+.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[
]*.*[ ]*\.pif|\
name[=:; ]+.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[
]*.*[ ]*\.rar|\
name[=:; ]+.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[
]*.*[ ]*\.scr|\
name[=:; ]+.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[ ]*.*[
]*.*[ ]*\.vbs)
{
:0 B
* (Content-Transfer-Encoding: base64)
$HOME/base64-virus.in
}
-={lsg}=-
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail