[Esd-l] Re: [Esa-l] Re: Swen worm: sanitizer local rule

[Brett Glass]

Here's what I'm using as a local recipe on clients' systems right now.
It seems to be effective; at least, I haven't seen any copies that
have gotten past it yet.

Note that it's a delivering recipe and is placed first in the file of
recipes so that memory and disk space are freed as soon as possible. 
It logs the disposal of the message if your logfile is not /dev/null.

--Brett

# Detect and remove Swen (patterns from the Net)
#
#Swen
:0BD
* > 100000
* ^Content-Transfer-Encoding: base64
* ^AAAA2AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1v
{
        DATE=`date +"%d/%m/%Y %T"`
        LOG="$DATE: Deleted a copy of Swen bound for $LOGNAME
"
        :0:
        /dev/null
}