Re: Procmail question-

[Adam Shand <larry@alaska.net>]

> Well there is a problem with this rule, it searches the entire email for
> VBS.  All i want it to search for is the attachment of a file name with
> the extension of .vbs Okay can this be done?  Im sure it can, just i can
> not find any info on how to make it do this.  Can someone purdy please
> help me :)

procmail doesn't understand mime so there is no way to tell it "delete
attachments which end with .vbs".  however what you can do is use a rule
like the below one.  we've been using this rule since the virus came out and
it's been working pretty well (caught almost 500 copies of it).
____________________________________________________________________________

PATH=/bin:/usr/bin:/usr/local/bin
LOGFILE=/share/etc/procmail.log

:0:
* ^Subject: ILOVEYOU
/share/etc/ILOVEYOU

:0:
* .*name=.*\.vbs.*
/share/etc/ILOVEYOU

:0
* < 50000
{

        :0 B:
        * .*(name=.*\.vbs|spyder@imail\.com).*
        /share/etc/ILOVEYOU
}
____________________________________________________________________________

if you make /share/etc/ILOVEYOU a directory procmail will deliver each
message to a seperate file in that directory.  the "< 50000" means that for
messages which fail the above header check it only scans the first 50k of
the body for matching text.

adam.