Re: [cobalt-users] Slightly OT: Blocking BadTrans virus

["Edward Bishop" <eddie@xxxxxxxxxxxxxxxx>]

> >From what I understand, another thing about Badtrans is that the return
> address starts with an underscore - not many real e-mail addresses start
> with that, so perhaps this is a way to identify these nasties for your
> filters?


> > I looked at all the headers for the infected Emails and they all had:
> >
> > Content-Type: multipart/related;
> > type="multipart/alternative";
> > boundary="====_ABC1234567890DEF_===="
> >
> > None of the other Emails had this so perhaps it could be used in your
> > filter.


Thanks for these suggestions which seem to make good sense to me.
Unfortunately I don't understand procmail enough to use them but the people
on the list pointed to by Charlie:

mailto:procmail-request@xxxxxxxxxxxxxxxxxxxx?subject=subscribe

do and it looks as though they have nearly come up with a working solution.
So I am lurking over there with the intention of  waiting until they have
done it, and then asking meekly if there's any difference in doing it on a
Cobalt.

We should probably stop this thread on cobalt-users now since it's by no
means Cobalt specific.

--
Eddie