[Esd-l] Re: [Esa-l] Re: Swen worm: sanitizer local rule

Brett Glass brett at lariat.org
Wed Oct 1 12:49:38 PDT 2003

Here's what I'm using as a local recipe on clients' systems right now.
It seems to be effective; at least, I haven't seen any copies that
have gotten past it yet.

Note that it's a delivering recipe and is placed first in the file of
recipes so that memory and disk space are freed as soon as possible. 
It logs the disposal of the message if your logfile is not /dev/null.


# Detect and remove Swen (patterns from the Net)
* > 100000
* ^Content-Transfer-Encoding: base64
* ^AAAA2AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1v
        DATE=`date +"%d/%m/%Y %T"`
        LOG="$DATE: Deleted a copy of Swen bound for $LOGNAME

More information about the esd-l mailing list