Stories
Slash Boxes
Comments

NOTE: use Perl; is on undef hiatus. You can read content, but you can't post it. More info will be forthcoming forthcomingly.

use Perl

All the Perl that's Practical to Extract and Report

Facing the cascading upgrade hell More | Login | Reply

The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Without JavaScript enabled, you might want to use the classic discussion system instead. If you login, you can remember this preference.

procmail the bastard (Score:2)

by gnat (29)

I filter on a "Content-ID" header in the body. I procmail those to a mailfile that I periodically check and clean. I've only had about ten pieces of mail end up in that box that weren't Klez since I started doing that. It appears that MH or Pine sometimes (and I don't know when) adds the Content-ID header to attachments. Every bloody Klez virus has that header, though.
--Nat
- Klez rule's in (Score:1)
  
  by Elian (119) on 2002.05.09 13:54 (#8211) Homepage Journal
  
  We'll see if it catches non-klez mail, but for now, this SpamAssassin rule:
  rawbody CONTENT_ID /^Content-ID:/is describe CONTENT_ID Content-id in the body usually means Klez score CONTENT_ID 5.6
  looks to be a winner.
  
  Reply to This
  
  Parent

Get More Comments

Stories, comments, journals, and other submissions on use Perl; are Copyright 1998-2006, their respective owners.