[TriLUG] Spam e-mails with only an RTF attachment

[Cristóbal Palmer]

On Thu, Jun 17, 2010 at 3:04 PM, Tarus Balog <tarus at opennms.org> wrote:
> Gang:
>
> Hey, I've been getting tons of e-mails lately that consist of a random subject string and just an attachment with a filename that ends in .rtf.
>
> My guess is that this is some sort of trojan aimed at Windows users, but I was wondering if anyone had a .procmail recipe to detect an e-mail like this (no text and just an .rtf file as an attachment) that they could share.

Google got me to here:

http://www.ece.northwestern.edu/CFS/procmailrc.virusFilters

Which looks like a decent start. If you manage your own MTA, you could
block certain attachment types there, instead.

Cheers,
-- 
Cristóbal M. Palmer
ibiblio.org systems
UNC Chapel Hill