[linux-elitists] Swen

Matthew W. Miller mwmiller@columbus.rr.com
Sun Sep 21 23:59:44 PDT 2003


On Sun, Sep 21, 2003 at 07:34:36PM -0400, James Morris wrote:
>Does anyone have a good procmail recipe for catching this one?  I've 
>managed to block 26MB of it (just for my account), but can't keep up
>with all of the variations.

Remember to mkdir Mail and touch Mail/big and Mail/junk before you use 
these:

# Messages 100000 or larger are almost certainly Swen/Gibe worm spam.
# Toss aside big messages.
:0
* > 99999
$HOME/Mail/big

# 'Cleaned' worm messages are spammy too. Toss in junk folder.
:0
* ^X-Virus-Scanned:
* X-Virus-Scan-Result: Repaired
* This e-mail in its original form contained one or more attached files 
that were infected with
$HOME/Mail/junk
-- 
Matthew W. Miller <mwmiller@columbus.rr.com>



More information about the linux-elitists mailing list