Re: Procmail recipe for new Vote virus

[Chuck Mead <csm MoonGroup com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sat, 29 Sep 2001, Keith Morse posted the following:
KM>On Fri, 28 Sep 2001, Rodolfo J. Paiz wrote:
KM>> At 9/27/2001 10:45 PM -0700, you wrote:
KM>> >Chuck Mead? Procmail script?  Who? What? Why? When?  Explain yourself
KM>> >Sir.  Or at least divulge the direction to said procmail script.
KM>> 
KM>> <smile> You must not have been around about a week ago, Keith. We had a 
KM>> loooong conversation about it. Anyway, your answers:
KM>> 
KM>> Chuck Mead? Runs moongroup.com and is one of the nicer, more knowledgeable 
KM>> Linux users I "know". He may be wrong, but it happens very rarely and you 
KM>> at least listen very hard when he says something.
KM>> 
KM>> Procmail script?
KM>> 
KM>> ># Block the Nimba (W32 Nimda A mm) worm.
KM>> >:0 B
KM>> >* 
KM>> >^Content-Type:.*(audio\/x-wav|attachment|inline|multipart\/related|alternative);
KM>> >*name="(README|readme).(exe|exe)"
KM>> >$ABYSS
KM>> 
KM>> where previously defined ABYSS=/dev/null. Note that this should be five 
KM>> lines only; the third line may wrap in email but should be corrected.
KM>> 
KM>> The question? Can I simply change (README|readme) to (WTC|wtc) to stop the 
KM>> Vote virus? Should I also change the Content-Type? If so, to what?
KM>
KM>
KM>Gaa!  I did miss that, sheeesh.  I'm very familiar with Mr. Mead which
KM>what perked my interest. Thanks for the repost of info.

Keeripes... all this name dropping and familiarity... it... it's so 
touching... sniff... :-)

- -- 
csm
Free Dmitry!
Boycott Adobe!
Repeal the DMCA!
Stop the SSSCA!
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAju4yTYACgkQv6Gjsf2pQ0rgqwCfUdc2pTbOo33InLrxxyE9v73j
nUAAn1KPo71v/AlKMpskZqWItH+kIvHB
=+r6N
-----END PGP SIGNATURE-----