Random Linux Tips

Posted by Jemshad O K     Category: General

####[ GNU/ One Stanza Tip () ]#######################

Sub : Procmail recipe for OE Worms #060

Several M$ worms like SirCam, CodeRed use a dummied multi part
OE boundary, starting with an underscore ( _Outlook_ … ) . A
procmail recipe to segregate mail with such payload:

:0 D
* ^Content-Type:
* multipart.*”—-[A-F0-9]+_Outlook_Express_message_boundary”
/home/{user}/mail/danger_here

####[usmbish (at) users.sourceforge.net]######################

Tags: , , ,

Related posts