By default, procmail will only look at the headers of a message. To
make it look in the body to, try something like:
:0B:
* gone.scr
/var/spool/infectedmail
or, if you trust the people sending you viruses (?!) to properly mime
encode things:
:0B:
* Content-Disposition: attachment; filename="gone.scr"
/var/spool/infectedmail
(The trailing ":" in the recipe makes procmail use a lock file, which
is a good idea when writing to a file--otherwise, if you happened to
get two matching mails at once, two instances of procmail would be
trying to write to the file at the same time.)
On 01/12/04 16:23 -0600, Richard Garand wrote:
> I was just trying to use procmail to filter the new goner virus (I already
> have a system that removes .scr attachments, but I want to get this
> working...). I started with the recipe
>
> :0
> * ^.*:.*"gone.scr"
> /var/spool/infectedmail
>
> which didn't match, and then I reduced it to
>
> :0
> * "gone.scr"
> /var/spool/infectedmail
>
> but this still doesn't match anything (sending an empty gone.scr to myself).
> I tried manually egreping the message (I saw a mention of procmail passing
> the recipe string to egrep in the manpage), and the second one matched two
> lines, so why doesn't procmail match at least the second rule?
Cheers,
--
Michael Rowe <[EMAIL PROTECTED]>
IM - [EMAIL PROTECTED] Prof - ACM, IEEE, Computer Soc.
Web - http://www.mojain.com/ Vice - Barley malt, brewed or
Key - http://mojain.com/keys/mrowe.asc distilled (hold the ice)
