Graham Smith wrote:
New Worm http://www.wired.com/news/print/0,1294,48613,00.html
If anyone is interested, the following was posted by John Hardin on the procmail list. It's for the sanitizer procmail rules. If your not using sanitizer it can be modified to trash the email rather then marking it for sanitizing. If you don't know what I mean, I can post an example. # Trap BadTrans? (signature as of 11/26/2001) # :0 * > 40000 * < 50000 * ^Subject:.*Re: * ^Content-Type:.*multipart/related;.*"multipart/alternative";.*boundary="====_ABC1234567890DEF_====" { :0 B hfi * ^Content-Type: audio/x-wav; * ^Content-ID: <EA4DMGBP9p> * ^Content-Transfer-Encoding: base64 | formail -A "X-Content-Security: [$HOST] NOTIFY" \ -A "X-Content-Security: [$HOST] QUARANTINE" \ -A "X-Content-Security: [$HOST] REPORT: Trapped BadTrans worm - see http://securityresponse.symantec.com/avcenter/venc/data/w32.badtrans.b@mm.ht..." } Oh, by the way, I'm trying the mozilla mailer so if this blows up someones mailer I'd like to here it, unless it's a flame in which case it'll be deleted before I even see it. :) -- S.Toms - smotrs@mindspring.com - www.mindspring.com/~smotrs SuSE Linux v7.2+ - Kernel 2.4.4 Grabel's Law: 2 is not equal to 3 -- not even for large values of 2.