Fri, 09 Feb 2007

procmail filtering of exe files

I've been getting alot of spam/virus email lately that are just a blank email with an exe attachment named Greeting Card.exe or something equally retarded. My spam filter hasn't been picking up on them since there is no message to filter against so I decided to add a quick procmail rule to filter the messages out. I was able to do so by simply adding the following into my ~/.procmailrc file.
:0B:
* ^Content-Type: .*/.*;(.*$)?([ ].*$)*[ ]*name[ ]*=.*.(com|exe|pif|bat|scr)
badattachments

The :0 is the procmail tag that says this is a rule, the B tells it to scan the message body which it does not do by default. The second line is the regular expression that matches the content type line for any attachments with com, exe, pif, bat, src extension. The thrid line simply moves all that mail into my mailbox called badattachments. This could be /dev/null as well if you wanted to just rid of them right away.

posted at: 01:54 | path: /general | permanent link to this entry


2019-Jun
2019-May
2018-Dec
2018-Jan
2017-Aug
2017-Jun
2017-May
2016-Nov
2015-Dec
2015-Nov
2015-Oct
2015-Jul
2015-Jun
2014-Dec
2012-Oct
2012-Sep
2012-Jun
2012-Feb
2012-Jan
2011-Dec
2011-Sep
2011-Aug
2011-May
2011-Feb
2010-Jun
2010-Apr
2010-Jan
2009-Sep
2009-Jul
2009-May
2009-Jan
2008-Oct
2008-Sep
2008-Jun
2008-May
2008-Jan
2007-Nov
2007-Oct
2007-Aug
2007-Jun
2007-May
2007-Mar
2007-Feb
2007-Jan
2006-Nov
2006-Oct
2006-Sep
2006-Aug
2006-Jun
2006-Apr
2006-Jan
2005-Dec
2005-Nov
2005-Oct
2005-Sep
2005-Aug
2005-Jul
2005-Jun
2005-May
2005-Apr
2005-Mar
2005-Feb
2005-Jan
2004-Dec
2004-Nov
2004-Oct
2004-Sep
2004-Aug
2004-Jul
2004-Jun
2004-May

Powered by PyBlosxom | RSS 2.0