[H-GEN] Email filtering

[David Duffy]

[ Humbug *General* list - semi-serious discussions about Humbug and     ]
[ Unix-related topics. Posts from non-subscribed addresses will vanish. ]

Arjen Lentz wrote:

>Hi David,
>
>On Wed, 2003-09-24 at 18:16, David Duffy wrote:
>  
>
>>With the current wave of virus emails (Microsoft lookalikes),
>>what's the best way to automatically reject/clobber them?
>>I guess I could use a procmail rule (tried but failed!)
>>    
>>
>
>Here's a little procmail rule that I found highly effective - that is,
>it literally caught zillions of mails. I used to track it, but it goes
>to /dev/null on my main server now because I don't think anyone needs to
>send me any attachment of those types....
>I'm not so regex savvy so the pattern may be less than optimal ;-)
>
># Klez, Elkern & co viruses
># Basically catch all executable attachments)
>:0 B
>* ^Content-Type: .*/.*;$?.*NAME=.*\.(exe|com|bat|pif|scr|lnk)
>/dev/null
>

I like that one. Very nifty. Sometimes I send/receive exe files
but I can always wrap them in a zip file when required.
I'll send it to /spam for now in case of false positives.
".procmailrc here I come!"
David...

-- 
___________________________________________
David Duffy        Audio Visual Devices P/L
U8, 9-11 Trade St, Cleveland 4163 Australia
Ph: +61 7 38210362   Fax: +61 7 38210281
New Web: www.audiovisualdevices.com.au
___________________________________________



--
* This is list (humbug) general handled by majordomo at lists.humbug.org.au .
* Postings to this list are only accepted from subscribed addresses of
* lists 'general' or 'general-post'.  See http://www.humbug.org.au/