This is a first draft of a recipe to block the MyDoom (or SCO.A) virus
The signature I got off the net. Comments, test results or improvement
suggestion requested. I am not sure how well it works (or even if it
works).
:0 B
* > 20000
* < 36000
*^aHR0cDovL3ZpbC5uYWkuY29tL3ZpbC9jb250ZW50L3ZfMTAwOTgzLmh0bQ==
* ^ *Content-Disposition: attachment;
* filename=".*\.(pif|exe|scr|zip|bat|cmd)"
{
LOG='MyDoom virus detected"
:0
/var/log/virusmail
}
Thanks,
Regards,
Lyle Evans
evansl(_at_)rackears(_dot_)com
rackmount brackets for many networking and ISP equipment chassises
http://www.rackears.com
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail