Re: [Exim] Nimda Worm

On Wed, 19 Sep 2001, Odhiambo Washington wrote:

> I was wondering if anyone has been hit hard enough by this NIMDA worm and has
> come up with a filter for it.

try this (based on info from a local list):

if
$h_content-type: contains "multipart\/related" and
$h_content-type: contains "type=\"multipart\/alternative\";" and
$h_content-type: contains "boundary=\"====_ABC1234567890DEF_====\""
then
save /var/mail/rejected_messages/nimda/
fail text "whatever\n"
seen finish
endif

this is my first filter, also thrown together in a hurry,
comments/improvements are welcome..

also i don't have nimda (could please someone send me one?), but it
stops a message hand-crafted according to the info on the
abovementioned info.

--
[-]