Re: Procmail recipe for filtering Sobig-originated E-mail?

[Omer Zak]

Thanks to everyone who yelled "RTFM", in the most polite way possible.
I googled and upgraded my .procmailrc file.
The rule which I added is:
:O
* > 99000
* < 120000
* ^Content-Type:.*multipart/mixed;
{
     :O B
     * ^See the attached file for details
     * ^Content-Transfer-Encoding: base64
     * ^Content-Disposition: attachment;
     * ^.*filename=".*\.pif"
     /dev/null
}
The rule does not catch messages whose attached file's extension is .scr.
I'll add a rule to catch those messages once I feel comfortable with the 
rule
which I already added.

Nadav Har'El wrote:

But the big problem isn't the virus - it's the bounces from all the people
that got this virus supposedly from me. These bounces include a anti-virus
spam (anti-virus makers know there is no point in replying to viruses, but
they do so anyway, as a way to "legitimately" spamvertize their products)
and bounces from non-existant or out-of-quota addresses. In the last two
days I got almost 400 bounces (!) and only about 40 copies of the actual
virus.
For me, as for now, the big problem is not the bounces but the virus 
E-mails themselves.
With each E-mail being 100KB long, and with about 180 E-mail messages a 
day, I have
to empty my mailbox very often or risk losing legitimate E-mail due to 
overflowing
mailbox.

                                            --- Omer
My opinions, as expressed in this E-mail message, are mine alone.
They do not represent the official policy of any organization with which
I may be affiliated in any way.
WARNING TO SPAMMERS:  at http://www.zak.co.il/spamwarning.html


=================================================================
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word "unsubscribe" in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]