[H-GEN] Email filtering

[Arjen Lentz]

[ Humbug *General* list - semi-serious discussions about Humbug and     ]
[ Unix-related topics. Posts from non-subscribed addresses will vanish. ]

Hi David,

On Wed, 2003-09-24 at 18:16, David Duffy wrote:
> With the current wave of virus emails (Microsoft lookalikes),
> what's the best way to automatically reject/clobber them?
> I guess I could use a procmail rule (tried but failed!)

Here's a little procmail rule that I found highly effective - that is,
it literally caught zillions of mails. I used to track it, but it goes
to /dev/null on my main server now because I don't think anyone needs to
send me any attachment of those types....
I'm not so regex savvy so the pattern may be less than optimal ;-)

# Klez, Elkern & co viruses
# Basically catch all executable attachments)
:0 B
* ^Content-Type: .*/.*;$?.*NAME=.*\.(exe|com|bat|pif|scr|lnk)
/dev/null


Regards,
Arjen.
-- 
Arjen Lentz, Technical Writer, Trainer
Brisbane, QLD Australia
MySQL AB, www.mysql.com

Melbourne 1 December (5 days): Using & Managing MySQL Training
Training,Support,Licenses,T-shirts @ https://order.mysql.com/?marl


--
* This is list (humbug) general handled by majordomo at lists.humbug.org.au .
* Postings to this list are only accepted from subscribed addresses of
* lists 'general' or 'general-post'.  See http://www.humbug.org.au/