sircam procmail recipe (was: Re: asshole virus emailers)

Dpk dpk@egr.msu.edu
Wed, 1 Aug 2001 09:13:23 -0400


On Tue, Jul 31, 2001 at 11:56:49PM -0400, Ben Pfaff wrote:

   Okay, the following seems to work okay.  Anyone who's more
   experienced with procmail want to comment on the recipe below?
   
   ----------------------------------------------------------------------
   MAILDIR=/home/blp/procmail
   LOGFILE=/home/blp/procmail/log
   LOGABSTRACT=all
   
   :0:
   * B ?? I send you this XXXXXXXXXX to have your advice
   sircam
   ----------------------------------------------------------------------
   
   I've XXXXXXX'd out the line above so that I can actually see the
   replies to this message!

According to the Cert advisory, this will only block one of the
variants of the SirCam worm.  This is what I am using:

# English version
:0 Bh
* ^Hi! How are you?
* ^See you later
* ^Content-Disposition: attachment
(do whatever you want here)

# Spanish version
:0 Bh
* ^Hola como estas
* ^Nos vemos pronto, gracias.
* ^Content-Disposition: attachment
(do whatever you want here)

Dennis