In your file you have this comment
# Run with e.g.:
# LISTFOLDER=somepath/virus-rubbish
# INCLUDERC=yourpath/virusnotification.rc
# or
# LISTFOLDER=
# INCLUDERC=yourpath/virusnotification.rc
# :0
# * ISVIRUSNOTIFICATION ?? ^^1^^
# { ... }
# in your $HOME/.procmailrc (you can leave out LISTEMAIL if it's the same as
# LISTNAME).

Can I just use your file as my .procmailrc file and add these lines to it

LISTFOLDER=/dev/null
LOGFILE=mail-deleted.log

as I am happy to delete these e-mails. What I am trying to do is get rid
of them from the server as FAST as I can. Is there anything in your
file which cannot be there if it is not an include file?

What I am using now is

#Delete emails but make a log of it
LOGFILE=mail-deleted.log
VERBOSE=true

:0
* cr@home.gen.nz
* ^Content-Type: multipart/
* > 100000
/dev/null

A lot cruder than yours but it does most of what I want - yours will do
it all. I would also add a few more sections to it as there are a few more
e-mails I want to delete.

Chrissy.

----- Original Message -----
From: "Volker Kuhlmann" <list0570@paradise.net.nz>
To: <adsl@lists.unixathome.org>
Sent: Saturday, October 11, 2003 5:43 PM
Subject: Re: JetStream bill for a several thousand dollars

> ----- Forwarded message from Volker Kuhlmann <hidden@paradise.net.nz> -----
>
> From: Volker Kuhlmann <hidden@paradise.net.nz>
> Subject: Re: JetStream bill for a several thousand dollars
> Date: Sat, 11 Oct 2003 17:24:22 +1300
> To: adsl@lists.unixathome.org
>
> > I am trying to write a .procmailrc file to stop them before I download them
> > as I believe that I will blow my 5 Gig cap if I am not careful. I am not getting
>
> I made a procmail filter which tags (and optionally saves) all this
> virus-related cr*p, including dumb notifications like I sent someone
> one. It's been very successful and approaches 100% hit rate after 2
> more days of fine-tuning. Meant to be used with INCLUDERC=
>
> http://volker.dnsalias.net/soft/procmail/virusnotification.rc
>
> It does however need the whole email for mst of the tests. I am not
> sure about what kind of header-only filter would match these virus
> emails. There simply is no reliable pattern in the headers. The
> subject: changes all the time, the from: is usually bogus and dumping
> everything from @microsoft.com is not what you want to do.
>
> I don't see how the suggested mime header check for postfix could
> possibly work, the mime-headers you want to look at, like
>
> Content-Type: audio/x-wav; name="cpbs.com"
>
> are all in the body, the email header only contains
>
> Content-Type: multipart/alternative;
>
> so you will have to read the whole email in the first place. Or is
> postfix able to repeat the header check as soon as it has read the
> start of each mime part, and skipping the remaining body as soon as it
> enounters the x-wav? This wouldn't skip the whole body, but the bulk of
> it.
>
> Volker
>
> --
> Volker Kuhlmann is possibly list0570 with the domain in header
> http://volker.dnsalias.net/ Please do not CC list postings to me.
>
> ----- End forwarded message -----
>
> --
> Volker Kuhlmann is possibly list0570 with the domain in header
> http://volker.dnsalias.net/ Please do not CC list postings to me.
>
> --
> This message is part of the NZ ADSL mailing list.
> see http://unixathome.org/adsl/ for archives, FAQ,
> and various documents.
> To unsubscribe: send mail to majordomo@lists.unixathome.org
> with "unsubscribe adsl" in the body of the message
>
>

-- 
This message is part of the NZ ADSL mailing list. 
see http://unixathome.org/adsl/ for archives, FAQ, 
and various documents. 
To unsubscribe: send mail to majordomo@lists.unixathome.org 
with "unsubscribe adsl" in the body of the message