[Exim] Yet Another Filter to block SoBig.F

A little late I'm sure, but a few people have been asking for it, so
here it is.
This is a simple system filter that silently drops mail after it comes
in. The sending is given no notification. The recipient is given no
notification.

Please note, the lines starting 'if $header_Content-type' and 'and
$message_body', are very long. Please be sure they're not wrapping when
you save them.


# Exim filter

if $header_X-MailScanner matches "Found to be clean"
then
    if $header_Content-type matches "(multipart/mixed)" and $header_X-Mailer matches "Microsoft Outlook Express 6.00.2600.0000"
    and $message_body matches "name(:|=)\"(your_document.pif|document_all.pif|thank_you.pif|your_details.pif|details.pif|document_9446.pif|application.pif|wicked_scr.scr|movie0045.pif)\""
    then
        seen finish
    endif
endif

--
Avleen Vig
Systems Administrator
Personal: www.silverwraith.com
EFnet:    irc.mindspring.com (Earthlink user access only)