[42697] in North American Network Operators' Group
procmail nimda e-mail filter
daemon@ATHENA.MIT.EDU (Bryan Bradsby)
Wed Sep 19 02:38:33 2001
Date: Wed, 19 Sep 2001 01:37:47 -0500 (CDT)
From: Bryan Bradsby <Bryan.Bradsby@capnet.state.tx.us>
To: <nanog@merit.edu>
In-Reply-To: <20010919003249.L85635@buffoon.automagic.org>
Message-ID: <20010919013231.V20781-100000@lark.capnet.state.tx.us>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Errors-To: owner-nanog-outgoing@merit.edu
# Detect W32.nimda worm and move to /var/tmp/nimda.DATE.username
# w32.nimda.amm
#
:0 i
* ^Content-Type: multipart/related
* ^Content-Disposition: Multipart message
* ^Subject: .*Software\\Microsoft\\Windo.*$
{
:0
{ DATE_=`date "+%Y%m%d"` }
:0 B
* ^Content-Type: audio/x-wav
/var/tmp/nimda.$DATE_.$LOGNAME
}
recycled electrons from sircam...
-bryan bradsby
NOC: 512-475-2432
Texas State Government Net
--
Any technology distinguishable from magic is insufficiently advanced.
