Re: [cobalt-users] Getting Mail Bombed!

["Steve Werby" <steve-lists@xxxxxxxxxxxx>]

"David Lucas" <david@xxxxxxxxxxxxxxxx> wrote:
> Carrie the attachments are all different.  They are pulled from the email
> senders "My documents" directory.  I have seen pif, doc, com and lnk
> extensions.  They were originally doc, zip and no extension files.  I
> understand that they can come from xls files also.

Examine the headers carefully.  If there's nothing consistent that can be
used to build a procmail rule then it sounds like any solution will
potentially have many false positives.  procmail can match on any header, no
matter how obscure.

--
Steve Werby
President, Befriend Internet Services LLC
http://www.befriend.com/