PDA

View Full Version : Delete email with .pif attachment



andrew
10-10-2004, 11:44 PM
Dear All,

Does anyone know how to delete the emails that contain a .pif attachment on the server? I have SpamAssassin setup, but I am very new to it.

My wife (POP account) gets tons of emails contain .pif attachment everyday, and lots of them are virus (also blocked by Norton Anti-Virus on her machine). I was wondering if I can just delete those emails directly on the server before get to her POP account.

Any suggestions are very much appreciated.

Many Thanks,
Andrew

jalal
10-11-2004, 01:31 AM
procmail is the weapon of choice in this situation. I have the following in my /etc/procmailrc file (I use Linux so I have no interest in any sort of Windoze file).

:0 B
* Content-Disposition: attachment
* name=.*\.(com|exe|pif|scr|bat|lnk|shf|vbs)
{
:0 B:
/dev/null
}

:0 HB
* > 90000
* ^Content-(Type|Disposition): .* name=".*\.(pif|exe|com|bat|lnk)"
{
:0
/dev/null
}

andrew
10-11-2004, 04:56 PM
Thanks Jalal. It works perfectly.

john_collins
12-14-2004, 09:58 PM
This looks like an extremely valuable tip. However, I'm tiptoeing into areas where I've never been before. I opened procmail.rc and don't know where to put your addition. Here it is before modification.
(BTW--is there where you add an instruction to delete all mail tagged as spam? Or forward it to a black-hole account?)

Thanks,

John

Standard procmailrc:


# Added By HostDir
VERBOSE = "no"
LOGABSTRACT = "no"
SHELL = "/bin/sh"

RESIDUE = `/bin/procmail_checker $DEFAULT $LOGNAME 2>/dev/null`
:0
* ? test $RESIDUE != "unlimited"
{
:0
* > $RESIDUE
{
LOGFILE=/proc/self/fd/2
LOG="554 - Mailbox quota exceeded by $LOGNAME
"
EXITCODE=69
:0
/dev/null
}
}
# SPAMASSASSIN BLOCK

# The condition line ensures that only messages smaller than 250 kB
# (250 * 1024 = 256000 bytes) are processed by SpamAssassin. Most spam
# isn't bigger than a few k and working with big messages can bring
# SpamAssassin to its knees.
:0
* ! ^FROM_DAEMON
* < 256000
{
:0 fw: /var/lock/spamassassin.lock
| /spamassassin
}
# END SPAMASSASSIN BLOCK

john_collins
12-15-2004, 05:04 PM
Never mind. I figured it out. Works GREAT!

THANKS!

John