RE: [cobalt-users] Bouncing Email's with Attachements W32.Sircam.Worm@mm

["Colin J. Raven" <cjraven@xxxxxxxxxxx>]

> > ---------------cut below this line----------------
> > :0:sircam.lock
> > * B ?? Hi\! How are you(\?|=3F)
> > * 1^0 B ?? I send you this file in order to have your advice
> > * 1^0 B ?? I hope you like the file that I send( t)?o you
> > * 1^0 B ?? This is the file with the information that you ask for
> > * B ?? See you later(\.|=2E) Thanks
> > /home/tmp/sircam
> > #That could also be /dev/null instead
> >
>
> This looks like an extremely useful technique, but I can't get it
> to work. I
> didn't have a file /etc/procmailrc so I created it. I also tried
> .procmailrc
> after reading the archives. In both cases I restarted sendmail.
"After reading the archives"?? <gasp> Are my eyes deceiving me?? I think I
just read a post that said someone read the archives and gleaned info from
'em....wow man I'm impressed...and sir...you just got yerself some help!!


First of all, make sure you turn on verbose logging (as well as telling
procmail where your logfile is!!)
Soooo you need (among other things) the following at the top of your
/etc/procmailrc (or .procmailrc)
       PATH=/bin:/usr/bin:/usr/bin
       MAILDIR=$HOME/Mail      #you'd better make sure it exists (or else
modify it to lowercase "mail")
       DEFAULT=$MAILDIR/mbox   #completely optional
       LOGFILE=$MAILDIR/log    #recommended
	 LOGABSTRACT=ALL		 #A "Good Thing" (tm)
	 VERBOSE=ON			 #If you need to debug you need this set "on"
			             #turn it off after you know stuff works as intended
					 #else your logfiles get to be huge.

Chances are your permissions on /etc/procmailrc are wrong. 700 is nice.

Sendmail doesn't require restarting, it's just the MTA, in this instance
procmail is acting as the LDA (Local Delivery Agent) It might be useful to
know what version of procmail you are running. At the command prompt do
this:
user@someplace$procmail -v
procmail will gracefully emit its version information.

Get all of the above done, then post a sample of your verbose logging and
we'll see what's happening.
Oh yeah, I gotta say this <laugh>:
man procmail
man procmailrc
man procmailex
man procmailsc

Regards & HTH,
-Colin
--
Colin J. Raven