Try the following (riped from comp.mail.sendmail)
---
# attachments we don't like
CAvbs
# stuff all Content-Disposition: headers to our ruleset
HContent-Disposition: $>CheckContentDisposition
#
# checking content disposition
#
Kbadattach regex -n vbs$
D{noattach} "501 We do not accept vbs attachments - Please attach it as
part of a zip file or send the vbs file as plain text - Contact
postmaster@$j with any questions."
SCheckContentDisposition
Rattachment; filename=$+ $1
R$+ $: $(dequote $1 $)
R$+$=A $#error $: ${noattach}
R$+ $: $(badattach $1 $: BAD $)
RBAD $#error $: ${noattach}
R$* $@ OK
---
But this is not perfect and some cases can be missed, It's better
to code it in collect.c.
Ereli <[EMAIL PROTECTED]> wrote:
> This could be useful.
>
> ----- Original Message -----
> From: Dave Rigby
> To: [EMAIL PROTECTED]
> Sent: Thursday, May 04, 2000 9:03 PM
> Subject: [Exim] the 'ILOVEYOU' virus - a simple filter
>
>
> Hi.
>
> The ILOVEYOU virus has hit our mail =ervers in the UK, but I managed I implement a
>filter on exim (hopefully) before much =amage was caused. It's nothing complicated -
>just redirects all emails with =he appropiate subject "ILOVEYOU" to a specified
>mailbox.
>
> Save this as a filter file on your system:
> # =xim filter
> if $header_subject: is "ILOVEYOU"
> then
> deliver suspicious@<yourdomain.com>
> endif
>
> and set in the main config =/FONT>
> message_filter =STRONG>= <path to filter file>
>
>
> Hope people find this =seful
>
>
> David Rigby
>
> [EMAIL PROTECTED]
=================================================================
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word "unsubscribe" in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]
