Re: OT: M$ Outlook Virus

[brian moore <bem@cmc.net>]

On Tue, Feb 13, 2001 at 10:41:35AM -0600, Rob VanFleet wrote:
> On Tue, Feb 13, 2001 at 03:46:11PM +0100, Joris Lambrecht wrote:
> > while it is tru you can remove most scriptin support with removin the
> > microsoft scripting host, what if you're a developer ? Or you're environment
> > requires you to be able to run scripts ?
> 
> I surprised no one has thought of this....
> 
> *** Change the file association ***
> 
> I know this only works for attachments rather than the embedded ones,
> but it sounds like it would handle this latest one just fine.  Just have
> .vbs open in notepad rather than execute the scripting engine.

Or if you control the server and have a pile of windows clients (I'm
not about to change the assocations on a few thousand windows
machines...).. put the following in /etc/procmailrc:

:0
*^Content-type: (multipart/mixed|application/octet-stream)
{
    :0 B
    *^Content-Disposition: (attachment|inline);
    *filename=".*\.(vbs|wsf|shs)"
    {
       SHELL=/bin/sh
       :0 fbw
       |/bin/sed -e 's/\(name=".*\.\(vbs\|wsf\|shs\)\)"/\1.txt"/I'
    }
}


And magically, all .vbs crap becomes .txt :)

-- 
CueCat decoder .signature by Larry Wall:
#!/usr/bin/perl -n
printf "Serial: %s Type: %s Code: %s\n", map { tr/a-zA-Z0-9+-/ -_/; $_ = unpack
'u', chr(32 + length()*3/4) . $_; s/\0+$//; $_ ^= "C" x length; } /\.([^.]+)/g;