I added this to my /etc/procmailrc a few weeks ago:
:0 fw   
* ^FROM_DAEMON
* > 20480
| formail-I"Subject: [WARNING, large daemon bounce] $SUBJECT"
:0 Efw
* > 4000
* < 80000
* B ?? name=.*\.zip
| formail -I"Subject: [WARNING: possible zip virus file] $SUBJECT"
However, I am still getting 20-40KB zip viruses without any warning
getting written to the subject.  I have recently added VERBOSE tags
around this pair of recipes, but haven't, of course, gotten one of
these viruses yet.
-- 
gkreme at gmail or kreme at kreme or syth at mac
 :: Don't get saucy with me, Bernaise ::
____________________________________________________________
procmail mailing list   Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail