> Well there is a problem with this rule, it searches the entire email for > VBS. All i want it to search for is the attachment of a file name with > the extension of .vbs Okay can this be done? Im sure it can, just i can > not find any info on how to make it do this. Can someone purdy please > help me :)
procmail doesn't understand mime so there is no way to tell it "delete attachments which end with .vbs". however what you can do is use a rule like the below one. we've been using this rule since the virus came out and it's been working pretty well (caught almost 500 copies of it). ____________________________________________________________________________ PATH=/bin:/usr/bin:/usr/local/bin LOGFILE=/share/etc/procmail.log :0: * ^Subject: ILOVEYOU /share/etc/ILOVEYOU :0: * .*name=.*\.vbs.* /share/etc/ILOVEYOU :0 * < 50000 { :0 B: * .*(name=.*\.vbs|[EMAIL PROTECTED]).* /share/etc/ILOVEYOU } ____________________________________________________________________________ if you make /share/etc/ILOVEYOU a directory procmail will deliver each message to a seperate file in that directory. the "< 50000" means that for messages which fail the above header check it only scans the first 50k of the body for matching text. adam.