I'm sure many of you are receiving these Worm_MiMail.r or .q virus varients in your mailbox today as their propigation increases.
The following procmail rules will remove any message with .pif, .scr,
and .exe and write to a file of your choosing.
--
:0 B:
* $ content-[^:]+:${WS}*.+(\<)*(file)?name${WS}*=${WS}*\/.+\.(pif|scr|exe)\"?$
${HOME}/DIR/FILENAME
:0 B:
* ^Content-Type: .*;$[ ]*(file)?name=\"?.*\.(pif|scr|exe)\"?$
${HOME}/DIR/FILENAME
:0 B:
* ^Content-Type: .*; [ ]*(file)?name=\"?.*\.(pif|scr|exe)\"?$
${HOME}/DIR/FILENAME
--
more info on the viruses here:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MIMAIL.R
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MIMAIL.Q
signature.asc
Description: This is a digitally signed message part
