Re: [cobalt-users] Bouncing Email's with Attachements W32.Sircam.Worm@mm

["Scott w" <webbcite@xxxxxxxxxxx>]

> #################################################################
> #This stops a bunch of bad news attachements from coming through
> #attachments are defined in the "filename" variable
> #how to deal with them is laboriously described below
>
> :0
> *^Content-type: (multipart/mixed|application/octet-stream)
> {
>     :0 HB
>     *^Content-Disposition: (attachment|inline);
>     *filename=".*\.(vbs|wsf|eml|shs|exe|nws|chm|pif|vbe|hta|scr)"
>     {
>        SHELL=/bin/bash
>        :0 fhbw
>        |/bin/sed -e \
> 's/\([nN][aA][mM][eE]=".*\.[vV][bB][sS]\)"/\1.txt"/' \
>                      -e \
> 's/\([nN][aA][mM][eE]=".*\.[wW][sS][fF]\)"/\1.txt"/' \
>                      -e \
> 's/\([nN][aA][mN][eE]=".*\.[eE][mM][lL]\)"/\1.txt"/' \
>                      -e \
> 's/\([nN][aA][mN][eE]=".*\.[nN][wW][sS]\)"/\1.txt"/' \
>                      -e \
> 's/\([nN][aA][mM][eE]=".*\.[sS][hH][sS]\)"/\1.txt"/' \
>                      -e \
> 's/\([nN][aA][mM][eE]=".*\.[eE][xX][eE]\)"/\1.not"/' \
>                      -e \
> 's/\([nN][aA][mM][eE]=".*\.[cC][hH][mM]\)"/\1.txt"/' \
>                      -e \
> 's/\([nN][aA][mM][eE]=".*\.[pP][iI][fF]\)"/\1.txt"/' \
>                      -e \
> 's/\([nN][aA][mM][eE]=".*\.[hH][tT][aA]\)"/\1.txt"/' \
>                      -e \
> 's/\([nN][aA][mM][eE]=".*\.[vV][bB][eE]\)"/\1.txt"/' \
>                      -e \
> 's/\([nN][aA][mM][eE]=".*\.[sS][cC][rR]\)"/\1.txt"/' \
>                      -e \
>        {
>         :0:
>         /home/tmp/crap
>          }
>         }
>
> ###############################################################

Great info!  But in order for me to get it to work without errors, I had to 
change change the following:

<snip>
's/\([nN][aA][mM][eE]=".*\.[sS][cC][rR]\)"/\1.txt"/' \
                     -e \
       {
        :0:
        /home/tmp/crap
         }
        }
</snip>

to

's/\([nN][aA][mM][eE]=".*\.[sS][cC][rR]\)"/\1.txt"/' \

        :0:
        /home/tmp/crap
         }
        }

Removing the "}: and the final "-e \" seemed to get it working.  I know 
nothing about procmail and am not very good with regular expressions, but it 
seems to be working correctly now.

Anyway, anyone have any comments?  Did I break it or fix it?

Thanks,
Scott




_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp