[TriLUG] Had it with worm

[Jon Carnes]

On Wed, 2003-09-24 at 16:50, Mike Mueller wrote:
> I am thinking about retiring my email account that's getting all the worm 
> crap.  There's no slowing it.  Anybody else considering such a move?  I'm not 
> in the procmail/fetchmail/getmail crowd (yet) so I can't purge based on size 
> at the ISP's buffer or filter on incoming.  
> 
> Will killing the account help anything or will it create more noise?
> 
> Advice solicited.
> -- 
> Mike Mueller
> 324881 (08/20/2003)
> Make clockwise circles with your right foot. 
> Now use your right hand to draw the number "6" in the air.

Try this in your .procmailrc file (from another mailing list):

LOGFILE=procmaillog
MAILDIR=/home/mmueller/Mail

:0B:
*TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
virus-in


This matches the start of a base64-encoded PE executable.  I have no
desire to every receive them by email.  Despite the varying headers,
every(?) worm to date has contained this in the body.