procmail'ing for vbs attachments was Re: [cobalt-users] Babysitting

[Rik Thomas <rikt@xxxxxxxxxxxx>]

What has worked for us is creating a /etc/procmailrc and having this
content:

SHELL=/bin/bash
:0 B
* ^Content-Disposition: attachment;
* filename=".*\.vbs"
{
    :0 fbw
    |/bin/sed -e 's/\(name=".*\.vbs\)"/\1.txt"/'

    :0 c
    /var/log/love.txt
}


What this does is any attachment with a vbs extension gets renamed to
filename.vbs.txt so if the user doubleclicks on the attachment it will
bring it up in their registered text editor.

The second section copies the email to a log file for administor
reference.

What is nice about this is that no email gets lost in the void and you
aren't lamely filtering on the subject or the body which none is truly
failsafe against all of the variants out there.



On Fri, 5 May 2000, Dan wrote:

> Tried to send someone the warning that the mutated virus now may contain the
> subject Joke or Mothers Day
> 
>    ----- The following addresses had permanent fatal errors -----
> <snip @smh.com>
> 
>    ----- Transcript of session follows -----
> ... while talking to smh-mail.smh.com.:
> >>> DATA
> <<< 550 Banned text appeared in header or body: 'joke'
> 554 <snip @smh.com>... Service unavailable
> 
> So this means that any mail that may happen to use the word "joke" in the
> body of the message will now be bounced. IMO, that's a joke.
> --
> Dan Kriwitsky
> 
> 
> 
> _______________________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To Subscribe or Unsubscribe, please go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users
> 

-- 
Rik Thomas CTO rikt@xxxxxxxxxxxx
Delaware.Net, Inc. http://www.delaware.net
P:302.736.5515 F:302.736.5945 ICQ:879956

Check out our Tucows Linux Mirror
http://delaware.linux.tucows.com