[Esd-l] Anyone got a procmail signature for Klez?

[John D. Hardin]

On Sat, 27 Apr 2002, David Lucas wrote:

> >         | formail -A "X-Content-Security: [$HOST] NOTIFY" \
> >                   -A "X-Content-Security: [$HOST] DISCARD" \
> >                   -A "X-Content-Security: [$HOST] REPORT: Trapped
> >possible Klez worm - see
> >http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.tool.html"
> 
> Excuse my lack of knowledge here.  With your recipe, what happens to an 
> email that is caught?

If it's being used with the sanitizer, then the headers that tell the
sanitizer the message is "poisoned" are inserted. Later on, the
sanitizer's code will see those headers and quarantine or discard the
message.

--
 John Hardin KA7OHZ    ICQ#15735746    http://www.impsec.org/~jhardin/
 jhardin at impsec.org                       pgpk -a jhardin at wolfenet.com
  768: 0x41EA94F5 - A3 0C 5B C2 EF 0D 2C E5  E9 BF C8 33 A7 A9 CE 76 
 1024: 0xB8732E79 - 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
 "They [media giants] have no idea how to do business with resourceful
  human beings rather than passive vegetables. So they run to [the]
  government for protection."
                    -- Doc Searls on the SSSCA, in Linux Journal
-----------------------------------------------------------------------
   920 days until the Presidential Election