On 2004-01-28, Benjamin J. Stassart penned: > > For those that asked about filtering Novarg: > > http://www.securityfocus.com/archive/75/351599/2004-01-25/2004-01-31/0 > > In TMDA you should be able to do something like > > body -case 'UEsDBAoAAA' drop > body -case 'TVqQAAMAAA' drop > > I have not tested this. >
I saw a similar note on slashdot somewhere and used the following procmail rule: #novarg solution from /. :0 BD: * UEsDBAoAAA $HOME/mail/virus :0 BD: * TVqQAAMAAA $HOME/mail/virus It worked on the *one* message on which I've tried it ... fortunately, I haven't been seeing nearly the volume with this one that I did with swen. Yet. -- monique _____________________________________________ tmda-users mailing list ([EMAIL PROTECTED]) http://tmda.net/lists/listinfo/tmda-users
