At 11:25 2000-05-05 -0400, Origami Dreams wrote:
>On Thu, 4 May 2000, Gate wrote:
>
>> Anyone have something I can filter this thing out with?
>
>Add this recipe to your procmail filters:
>
>:0:
>* ^Subject:.ILOVEYOU
>killfiled
>
>It'll catch everything with ILOVEYOU in the message (including the one you
>sent me). I send mail to a folder for later review, you may wish to send
>it directly to /dev/null
I use the filter below to mark the message based on the string ".vbs" in
the body:
:0 Bf
* \\.vbs
| /bin/sed -e 's/^Subject:/Subject: [MAY CONTAIN A VIRUS]/'
All the variants are VBS files that run on the Windows Scripting Host.
Since the filename must be specified in the MIME headers, they can't avoid
being caught by this filter.
This filter will scan the entire message body ("B" option) so a busy mail
server may work a little harder.
Tony
--
Anthony E. Greene <[EMAIL PROTECTED]>
Homepage and PGP Key: <http://www.pobox.com/~agreene/>
If it's too good to be true, it's probably Linux
--
To unsubscribe: mail [EMAIL PROTECTED] with "unsubscribe"
as the Subject.
