[Esd-l] Re: [Esa-l] Re: Swen worm: sanitizer local rule

Brett Glass brett at lariat.org
Wed Oct 1 12:49:38 PDT 2003


Here's what I'm using as a local recipe on clients' systems right now.
It seems to be effective; at least, I haven't seen any copies that
have gotten past it yet.

Note that it's a delivering recipe and is placed first in the file of
recipes so that memory and disk space are freed as soon as possible. 
It logs the disposal of the message if your logfile is not /dev/null.

--Brett

# Detect and remove Swen (patterns from the Net)
#
#Swen
:0BD
* > 100000
* ^Content-Transfer-Encoding: base64
* ^AAAA2AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1v
{
        DATE=`date +"%d/%m/%Y %T"`
        LOG="$DATE: Deleted a copy of Swen bound for $LOGNAME
"
        :0:
        /dev/null
}



More information about the esd-l mailing list