Re: [cobalt-users] Bouncing Email's with Attachements W32.Sircam.Worm@mm

[Michael <mike@xxxxxxxxxx>]

>After Colin's intervention my /etc/procmailrc is as follows:
>
>SHELL=/bin/sh
>LOGFILE=/home/log/procmaillog
>#changed to /home/log/procmaillog to avoid filling up /var partition
>LOGABSTRACT=ALL
>VERBOSE=ON
>#################################################################
>#This stops a bunch of bad news attachements from coming through
>#attachments are defined in the "filename" variable
>#how to deal with them is laboriously described below
>
>:0
>*^Content-type: (multipart/mixed|application/octet-stream)
>{
>    :0 HB
>    *^Content-Disposition: (attachment|inline);
>    *filename=".*\.(vbs|wsf|eml|shs|exe|nws|chm|pif|vbe|hta|scr)"
>    {
>       SHELL=/bin/bash
>       :0 fhbw
>       |/bin/sed -e \
>'s/\([nN][aA][mM][eE]=".*\.[vV][bB][sS]\)"/\1.txt"/' \
>                     -e \
>'s/\([nN][aA][mM][eE]=".*\.[wW][sS][fF]\)"/\1.txt"/' \
>                     -e \
>'s/\([nN][aA][mN][eE]=".*\.[eE][mM][lL]\)"/\1.txt"/' \
>                     -e \
>'s/\([nN][aA][mN][eE]=".*\.[nN][wW][sS]\)"/\1.txt"/' \
>                     -e \
>'s/\([nN][aA][mM][eE]=".*\.[sS][hH][sS]\)"/\1.txt"/' \
>                     -e \
>'s/\([nN][aA][mM][eE]=".*\.[eE][xX][eE]\)"/\1.not"/' \
>                     -e \
>'s/\([nN][aA][mM][eE]=".*\.[cC][hH][mM]\)"/\1.txt"/' \
>                     -e \
>'s/\([nN][aA][mM][eE]=".*\.[pP][iI][fF]\)"/\1.txt"/' \
>                     -e \
>'s/\([nN][aA][mM][eE]=".*\.[hH][tT][aA]\)"/\1.txt"/' \
>                     -e \
>'s/\([nN][aA][mM][eE]=".*\.[vV][bB][eE]\)"/\1.txt"/' \
>                     -e \
>'s/\([nN][aA][mM][eE]=".*\.[sS][cC][rR]\)"/\1.txt"/' \
>                     -e \
>       {
>        :0:
>        /home/tmp/crap
>         }
>        }

Thanks alot for the help!  Of course, thank you Colin as well.

I have a question about the above recipe.  What does this recipe do exactly?  I realize this is a stupid question, maybe I am kinda dense but I just can't place it in my brain what it does...

Thanks 

Mike