[Asterisk-Users] MS Outlook

[Steven Critchfield]

On Mon, 2003-09-22 at 13:42, Brian West wrote:
> I second that... I have received a load of virii from people on this
> list..
> 
> Received: from torch.junct.com (sootbox.junct.com [65.168.64.10])
>         by www.bkw.org (8.11.6/8.11.6) with ESMTP id h8MIcEJ06998
>         for <brian at bkw.org>; Mon, 22 Sep 2003 13:38:14 -0500
> Received: from wdxmvur (unknown [207.41.124.63])
>         by torch.junct.com (Postfix) with SMTP
>         id 461DF4159; Mon, 22 Sep 2003 13:37:08 -0500 (CDT)

For those of you that have no reason whatsoever to receive windows
executables, here is a procmail rule that matches the beginning of a
windows executable no matter what it is named.

# Base 64 encoded windows executable
:0B:
*TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA


You can use this and deliver the mail wherever you want to. This works
on the last Sobig, klez and the Swen virus so far. This is what I had in
my virii folder to test it against.  

-- 
Steven Critchfield  <critch at basesys.com>