[Esd-l] Revised SoBig-F local rule

[Scott Taylor]

John D. Hardin said:

>
> Here's a revised rule based on the new SoBig-F variant's published
> details. It's a little more general than the one posted earlier.
>
> This is included in the sample local-rules file:
>
> 	http://www.impsec.org/email-tools/local-rules.procmail


John,

That new rule doesn't seem to catch:
REPORT: Trapped poisoned executable "wicked_scr.scr"

There are a couple of very long lines there, should they be one line?
ie:
* 9876543210^1 ^Content-(Type|Disposition):.*name *=
*"?(action|your_(details|document)|application|details|document(_all)?|screensaver|movie|thank_you|wicked_scr)_?[0-9]*\.zip"?