Re: procmail'ing for vbs attachments was Re: [cobalt-users] Babysitting

[Scott Blomquist <scott@xxxxxxxxxxxxxxxxxxx>]

Here is an expanded version from the Inet-access list, courtesy of Steve
VanDevender.  **Warning I have not yet tried it, Use appropriate
caution**
It covers all the different extensions which have been reported.

scott

Rik Thomas wrote:
> 
> What has worked for us is creating a /etc/procmailrc and having this
> content:
> 
> SHELL=/bin/bash
> :0 B
> * ^Content-Disposition: attachment;
> * filename=".*\.vbs"
> {
>     :0 fbw
>     |/bin/sed -e 's/\(name=".*\.vbs\)"/\1.txt"/'
> 
>     :0 c
>     /var/log/love.txt
> }
> 
> What this does is any attachment with a vbs extension gets renamed to
> filename.vbs.txt so if the user doubleclicks on the attachment it will
> bring it up in their registered text editor.
> 
> The second section copies the email to a log file for administor
> reference.
> 
> What is nice about this is that no email gets lost in the void and you
> aren't lamely filtering on the subject or the body which none is truly
> failsafe against all of the variants out there.
> 
> On Fri, 5 May 2000, Dan wrote:
> 
> > Tried to send someone the warning that the mutated virus now may contain the
> > subject Joke or Mothers Day
> >
> >    ----- The following addresses had permanent fatal errors -----
> > <snip @smh.com>
> >
> >    ----- Transcript of session follows -----
> > ... while talking to smh-mail.smh.com.:
> > >>> DATA
> > <<< 550 Banned text appeared in header or body: 'joke'
> > 554 <snip @smh.com>... Service unavailable
> >
> > So this means that any mail that may happen to use the word "joke" in the
> > body of the message will now be bounced. IMO, that's a joke.
> > --
> > Dan Kriwitsky
> > 
> >
> >
> > _______________________________________________
> > cobalt-users mailing list
> > cobalt-users@xxxxxxxxxxxxxxx
> > To Subscribe or Unsubscribe, please go to:
> > http://list.cobalt.com/mailman/listinfo/cobalt-users
> >
> 
> --
> Rik Thomas CTO rikt@xxxxxxxxxxxx
> Delaware.Net, Inc. http://www.delaware.net
> P:302.736.5515 F:302.736.5945 ICQ:879956
> 
> Check out our Tucows Linux Mirror
> http://delaware.linux.tucows.com
> 
> _______________________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To Subscribe or Unsubscribe, please go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users

-- 
      Scott V. Blomquist
   Director of Network Services
Inner Traditions International Rochester, VT
  802-767-3174(v) 802-767-3726(f)
    scott@xxxxxxxxxxxxxxxxxxx