flexfax: The Love Bug

[Andy Zbikowski <andyzb@ltiflex.com>]

Sorry this is only on topic since the Love Bug hit this mailing list.
For those of you who run a UNIX mail server with procmail installed, I
found a somewhat nifty procmail recipe to catch things like the Love
Bug.

 
ftp://ftp.rubyriver.com/pub/jhardin/antispam/procmail-security.php

Allready tested it out (sent a fake virus to my address from a different
machine) and the results of the test are:

>From the log file:
Sanitizing MIME attachment headers in "ILOVEYOU" from "Andrew S.
Zbikowski" <zibby@ringworld.org> to andyzb
msgid=<Pine.LNX.4.10.10005041323150.6282-101000@destiny.ringworld.org>
 Mangling executable filename "LOVE-LETTER-FOR-YOU.TXT.vbs".
 Mangling executable filename "LOVE-LETTER-FOR-YOU.TXT.vbs".
>From zibby@ringworld.org  Thu May  4 14:33:12 2000
 Subject: ILOVEYOU
  Folder: /var/spool/mail/andyzb  


>From the message I recived:
Name: LOVE-LETTER-FOR-YOU.TXT.13800DEFANGED-vbs
Type: unspecified type (APPLICATION/octet-stream)
Encoding: BASE64

Looks like it will keep windows from running it as a VBS script to me.
Rather effective, and the user still gets their e-mail. I think I like
it.

--
Andy Zbikowski, Sys Admin   | http://www.ltiflex.com
LTI Flexible Products, Inc. | "Reality is merely an illusion, 
21801 Industrial Blvd       |  albeit a very persistent one."
Rogers, MN  55374           |  -- Albert Einstein