From owner-freebsd-questions@FreeBSD.ORG Sat May 3 19:41:40 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2025937B401 for ; Sat, 3 May 2003 19:41:40 -0700 (PDT) Received: from dragoncrest.jasnetworks.net (dragoncrest.jasnetworks.net [65.194.254.12]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7237143FA3 for ; Sat, 3 May 2003 19:41:39 -0700 (PDT) (envelope-from dragoncrest@voyager.net) Received: from works.voyager.net (works.jasnetworks.net [192.168.0.2]) h43Lsqwb010395; Sat, 3 May 2003 21:54:52 GMT (envelope-from dragoncrest@voyager.net) Message-Id: <5.2.0.9.2.20030503225138.00a3e590@pop.voyager.net> X-Sender: dragoncrest@pop.voyager.net X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Sat, 03 May 2003 22:52:05 -0400 To: "Danny Horne" From: Dragoncrest In-Reply-To: <1094.192.168.1.10.1051967100.squirrel@webmail.clifftop.net > References: <5.2.0.9.2.20030503070833.00a04e40@pop.voyager.net> <5.2.0.9.2.20030503070833.00a04e40@pop.voyager.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed cc: freebsd-questions@freebsd.org Subject: Re: Setting spam assassin to capture viruses? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 04 May 2003 02:41:40 -0000 Uh, got a slight problem with that recipe you sent me. It's now corrupting my inbox. At 02:05 PM 5/3/03 +0100, Danny Horne wrote: >Dragoncrest was once thought to have said: > > Is there a way I can adjust by hand spam assassin's config file > or one of > > the files it uses to detect spam so that it also will look for attachments > > and if it finds anything with the extension of pif, scr, exe, or com, it > > will automatically flag it as spam and toss it in my spam folder? I want > > to set it to block certain types of attachments on email. Or would that be > > better done with procmail? Qpopper? Just curious what's the best way to > > block these. I figure if spam assassin will do it, I'll just adjust it so > > that it takes care of this for me. Thanks. > > >I use this procmail recipe for that - >:0 fhw >* B ?? ^Content-type: (audio|application) >* B ?? name=.*\.(com|exe|bat|scr|pif|hta|shs|vb[es]|ws[fh])\> >* Subject: *\/.+ >| formail -I "Subject: POSSIBLE VIRUS: $MATCH"