RE: [cobalt-security] Klez virus, sircam virus

["Brian" <brian-lists@xxxxxxxxxxxx>]

David,

This is great info, however I can not locate a procmailrc file. I have a
procmailrc.5 file in /usr/man/man5? Is this the same file you are referring
to? How do I implement this change - at the bottom or top of the file?

Any guidance would be greatly appreciated..

Brian.

<trim>

************************start of procmailrc ************************

SHELL=/bin/csh
LOGFILE=/var/log/procmail.log



:0
* 1^0 ^Content-Type:/*(multipart|attachment)
* 1^0 B ?? Hi\! How are you(\?|=3F)
* 1^0 B ?? I send you this file in order to have your advice
* 1^0 B ?? See you later (\.|=2E) Thanks
* 1^0 B ?? Hola como estas *\?
* 1^0 B ?? Te mando este archivo para que me des tu punto de vista
* 1^0 B ?? Nos vemos pronto, gracias\.
* 1^0 B ?? I hope you like the file that I send( t)?o you
* 1^0 B ?? This is the file with the information that you ask for
{
   :0
  /dev/null
}



:0
* ^Content-Type:.*(multipart|attachment)
{
  :0B
  * > 50000
  * ^Content-Type:[ 	]*(audio/x-|application)
  * 1^0 ()<i?frame[ 	]*src=(3d)?cid:
  * 1^0 ^--[^ ]+$$Content-
  * 1^0 ^--[^ ]+$--[^ ]+$
  /dev/null
}

************************end of procmailrc ************************