procmail
[Top] [All Lists]

Re: Problem with MS "update" spam

2005-05-24 11:34:56
At 09:22 2005-05-24 -0500, Pettit, Paul wrote:
# extentions that we want to never see come through
:0
*^Content-type: (multipart/mixed|multipart/alternative|application)

This is going to check the HEADER, not the body -- you indicated what content is in the BODY of an example message, but not what is in the header...

   :0 HB
    *^Content-Disposition: (attachment|inline);

Well, here you expect a semicolon immediatley after the keyword, while the body has:

Content-Disposition: attachment

   .exe    %s\%s   .zip    ; name="    msdownload  compressed

so right off, THAT isn't going to match.

Have you considered taking one of the failed messages and throwing it at your recipe with VERBOSE=ON and then checking the logfile?


*filename=".*\.(ad[ep]|asd|ba[st]|c[ho]m|cmd|cpl|crt|dbx|dll|exe|hlp|hta|in[
fs]|isp|itms|jar|js|js[fe]|lnk|ocx|md[etw]|ms[cipt]|nws|ocx|ops|pcd|pi|pif|p
rf|reg|scf|scr|sct|sh[bms]|swf|uue|vb|vb[esx]|vxd|wab|ws[cfh])"

You didn't include anything from your example message indicating a filename component...

but I'm not sure how accurate it is. When I forward the message to my self
the filter works perfect and I get the following: "[demime 1.01e removed an

Probably because your own mail software inserts the necessary headers you expect to find but are not present on the original message.

If you expect reproduceable results, you should take the saved message from a mailbox on the server and pipe that back at the procmail script (presuming the message in your inbox hasn't been otherwise modified by some subseqent rule).


---
 Sean B. Straw / Professional Software Engineering

 Procmail disclaimer: <http://www.professional.org/procmail/disclaimer.html>
 Please DO NOT carbon me on list replies.  I'll get my copy from the list.


____________________________________________________________
procmail mailing list   Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>