[Esd-l] Anyone got a procmail signature for Klez?

John D. Hardin jhardin at impsec.org
Sat Apr 27 18:37:01 PDT 2002

On Sat, 27 Apr 2002, David Lucas wrote:

> >         | formail -A "X-Content-Security: [$HOST] NOTIFY" \
> >                   -A "X-Content-Security: [$HOST] DISCARD" \
> >                   -A "X-Content-Security: [$HOST] REPORT: Trapped
> >possible Klez worm - see
> >http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.tool.html"
> Excuse my lack of knowledge here.  With your recipe, what happens to an 
> email that is caught?

If it's being used with the sanitizer, then the headers that tell the
sanitizer the message is "poisoned" are inserted. Later on, the
sanitizer's code will see those headers and quarantine or discard the

 John Hardin KA7OHZ    ICQ#15735746    http://www.impsec.org/~jhardin/
 jhardin at impsec.org                       pgpk -a jhardin at wolfenet.com
  768: 0x41EA94F5 - A3 0C 5B C2 EF 0D 2C E5  E9 BF C8 33 A7 A9 CE 76 
 1024: 0xB8732E79 - 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
 "They [media giants] have no idea how to do business with resourceful
  human beings rather than passive vegetables. So they run to [the]
  government for protection."
                    -- Doc Searls on the SSSCA, in Linux Journal
   920 days until the Presidential Election

More information about the esd-l mailing list