RootForum Community

Code: Select all

VERBOSE=off
LOGFILE=/var/log/procmail.log
#################### Viruses ####################
#
# Filter for viruses first. Unfortunately, mailing lists are not always
# virus-free these days.
# The construction with '{}' is used to log the reason for deletion of a
# message to the logfile, so I can check for false positives.
#

# This intercepts all attachments that contain base64 encoded Win32
# programs. These are almost certainly viruses.
#:0 B
#* ^Content-Transfer-Encoding:.*base64
#* ^TVqQAAMAAAAEAAAA//8AALg
#* 4fug4AtAnNIbg
#{
#  LOG="(virus) [win32 exe] "
#
#  :0
#  /dev/null
#}

# Filter the W32/KLEZ,W32/Yaha, W32/Sobig.F viruses. Sometimes the payload
# is stripped by an intermadiate mailer, but these headers survive.
# Innocent but annoying.
#:0 HB
#* ^Content-Type: multipart/(mixed|alternative)
#* ^Content-Type:.*(audio/x-|application|x-rasmol)
#* name=.*.(scr|com|bat|pif|lnk|exe)
#{
#  LOG="(virus) [KLEZ/YAHA/Sobig.F] "

#  :0
#  /dev/null
#}

# Filter an unknown virus (foo/malware)
#:0 HB
#* ^Content-Type: multipart/mixed
#* ^Content-Type: application/(octet-stream|x-zip-compressed)
#* ^UEsDBAoAAAAAA
#{
#  LOG="(virus) [malware] "

#  :0
#  /dev/null
#}

DROPPRIVS=yes 

# The condition line ensures that only messages smaller than 250 kB 
# (250 * 1024 = 256000 bytes) are processed by SpamAssassin. Most spam 
# isn`t bigger than a few k and working with big messages can bring 
# SpamAssassin to its knees. 

:0fw
* <500000
| /usr/bin/spamassassin

:0:
* ^X-Spam-Level: ******
/var/mail/webxpxx

:0e 
{ 
EXITCODE=$? 
}
#Bitte auskommentieren,wenn man die Spam-Mails wirklich löschen will: 
# :0: 
# Wenn es Spam ist, Mail löschen 
# * ^X-Spam-Status: Yes 
# /dev/null 
#EOF