----- Forwarded message from Volker Kuhlmann <hidden@paradise.net.nz> -----

From: Volker Kuhlmann <hidden@paradise.net.nz>
Subject: Re: JetStream bill for a several thousand dollars
Date: Sat, 11 Oct 2003 17:24:22 +1300
To: adsl@lists.unixathome.org

> I am trying to write a .procmailrc file to stop them before I download them
> as I believe that I will blow my 5 Gig cap if I am not careful. I am not getting

I made a procmail filter which tags (and optionally saves) all this
virus-related cr*p, including dumb notifications like I sent someone
one. It's been very successful and approaches 100% hit rate after 2
more days of fine-tuning. Meant to be used with INCLUDERC=

http://volker.dnsalias.net/soft/procmail/virusnotification.rc

It does however need the whole email for mst of the tests. I am not
sure about what kind of header-only filter would match these virus
emails. There simply is no reliable pattern in the headers. The
subject: changes all the time, the from: is usually bogus and dumping
everything from @microsoft.com is not what you want to do.

I don't see how the suggested mime header check for postfix could
possibly work, the mime-headers you want to look at, like

  Content-Type: audio/x-wav; name="cpbs.com"

are all in the body, the email header only contains

  Content-Type: multipart/alternative;

so you will have to read the whole email in the first place. Or is
postfix able to repeat the header check as soon as it has read the
start of each mime part, and skipping the remaining body as soon as it
enounters the x-wav? This wouldn't skip the whole body, but the bulk of
it.

Volker

-- 
Volker Kuhlmann			is possibly list0570 with the domain in header
http://volker.dnsalias.net/		Please do not CC list postings to me.
----- End forwarded message -----
-- 
Volker Kuhlmann			is possibly list0570 with the domain in header
http://volker.dnsalias.net/		Please do not CC list postings to me.
-- 
This message is part of the NZ ADSL mailing list. 
see http://unixathome.org/adsl/ for archives, FAQ, 
and various documents. 
To unsubscribe: send mail to majordomo@lists.unixathome.org 
with "unsubscribe adsl" in the body of the message