Toen ik Dallman Ross kietelde, kwam er dit uit:
I have made release ver. 1.3 of virussnag.rc available for viewing at
http://www.spamless.us/pub/procmail/virussnag.rc .
Maybe change the line
* $ $STOP^0 ! CTYPE ?? ^^multipart
into
* $ $STOP^0 ! CTYPE ?? ^^(attachment|multipart)
(and even put the ^0 inside both GO and STOP)
Maybe this $NASTYTEXT is more accurate:
NASTYEXT =
"${NASTYEXT:-((doc|txt|xls)\.)?(exe|hta|pif|scr|shs|vb[se]|ws[fh])}"
After such a $NASTYTEXT, you could put $DQ?$
This is more like what I use:
:0
* ^Content-Type:.*(attachment|multipart)
* B ?? ^Content-[a-z]+: \
.*($[$WS]+)*name=.*\.\
(bat|com|exe|hta|lnk|pif|scr|shs|vb[se]|ws[fh])(")?$
suspect
(but that misses the non-multipart ones)
--
Affijn, Ruud
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail