[Esa-l] Re: [Esd-l] Procmail Sanitizer local rule for SoBig .ZIP worm

Scott Taylor scott at dctchambers.com
Thu Jun 26 07:33:55 PDT 2003


At 21:04 06/25/03, John D. Hardin wrote:
>On Wed, 25 Jun 2003, John D. Hardin wrote:
>
> >         * ^Content-(Type|Disposition):.*name *= 
> ~*"?(your_details|application|document|screensaver|movie)\.zip"?
>
>...crap. How did that tilde creep in there?
>
>   * ^Content-(Type|Disposition):.*name *= 
> *"?(your_details|application|document|screensaver|movie)\.zip"?

We could end up writing a lot of rules for these things.  Eventually, 
SoBig.F will be out with a new list of file names.  Maybe we'll just have 
to eliminate .zip files too now. :(

Doesn't this fit into your Windows magic files?



More information about the esa-l mailing list