procmail recipe

[Jessica Zhu]

Hi,

Our mail system received a lot of spams today and the following is the 
pattern for these spams.

Subject: 
One of the following:


Re:Your Password 
Re:Registration Confirmation 
Re:Your email was blocked 
Re:mailing error 
Re: [blank]

Message: 
One of the following:


ok ok ok,,,,, here is it


Account and Password Information are attached!
Visit: http:/ /www.[random domain]


This is an automatically generated E-Mail Delivery Status Notification.
Mail-Header, Mail-Body and Error Description are attached

Appends one of the following randomly to the bottom of the message:


Attachment-Scanner: Status OK 
AntiVirus: No Virus found 
Server-AntiVirus: No Virus (Clean) 
http:/ / www.[random domain]

Attachment: 
One of the following:
our_secret.zip 
mail_info.zip 
error-mail_info.zip 
account_info.zip 
account_info-text.zip


I wrote a recipe to block the spam using procmail on our system. Somehow, 
the recipe didn't work. Could anyone help about this?

:0:
* ^Subject:.*(Your Password|Fwd: Your Password|Re:|Registration  
Confirmation|Fwd: Registration Confirmation|Your email was blocked|Fwd:  
Your email was blocked|mailing error|Fwd: mailing error)
* ^Content-Type:multipart/mixed
{
 *0 B
 * name=(our_secret|mail_info|error-mail_info|account_info|account_info-text).zip
 * Content-Transfer-Encoding: 7bit
 /var/log/mail-rejected
}
 
Jessica

---------- Forwarded message ----------
Date: Tue, 03 May 2005 19:24:45 UTC
From: Admin at nscc.edu
To: server at mathforum.org
Subject: Your email was blocked

This is an automatically generated E-Mail Delivery Status Notification.

Mail-Header, Mail-Body and Error Description are attached



*** AntiVirus: No Virus found
*** "MATHFORUM" Anti-Virus
*** http://www.mathforum.org