perlcgi has asked for the wisdom of the Perl Monks concerning the following question:

This is a quick, simple but imperfect one-liner to remove the ILOVEYOU virus from a mail text file. 
perl -ne 'BEGIN {$/="From: "} print unless /Subject:\s+
ILOVEYOU/' infectedfile > cleanedfile

[download]
Anyone want to improve it? Go to it monk!

Replies are listed 'Best First'.
Re: Perl slays the lovebug
by BBQ (Curate) on May 05, 2000 at 07:59 UTC
    Wouldn't it be safer to say 
    /^Subject:\s+ILOVEYOU/
    ? Otherwise you could be chopping off someone's email advising about a virus that spreads through email with a "Subject: ILOVEYOU".

    And just out of curiosity, where would you run this? On the mailq or on individual PO boxes?

    #!/home/bbq/bin/perl
    # Trust no1!
[reply]
      Hi BBQ, Yep, anchoring the 'Subject:' to start of line is an improvement, but inplace editing with -i would be better, if someone wants to do it. As written you can run it against /var/spool/mail/infected_user_mailfile on a unix system to purge all the LOVELETTERS and make a disinfected file. Probably best to manually replace infected with disinfected. It saves the users from deleting it manually from their inbox, (many users here had up to 80 copies apiece). Especially useful if they use pop or imap, and are not savvy, (provided they have'nt already downloaded to their '98/NT PC). This does'nt stop the mail getting to your system in the first place (we use a similiar regexp in an exim filter to search on the subject line, to do that. Good sendmail and procmail examples are available at: http://www.cert.org/advisories/CA-2000-04.html
[reply]
        Doh! That's my reply above BBQ - forgot to login, again!
[reply]

Back to Seekers of Perl Wisdom