[9fans] MYDoom-F pipeto pattern

[9fans] MYDoom-F pipeto pattern

[plan9fans]

Hi,

I've started to get more viruses:

Here is an replacement for the function in /mail/lib/pipeto.lib
for anyone who has similar problems.

It is tuned for Mydoom-A, Mydoom-F and the Swen.A

fn isvirus {
	virus=no
	if(grep -s '\.(exe|scr|bat|com|cmd)' $D/2/filename >[2]/dev/null){
		if (strings $D/2/body [2]>/dev/null | grep -s 'Try to pull my legs' ) virus=yes
		if (! ~ `{cat $D/2/body | rot13 | grep 'Version\\Explorer'} '' ) virus=yes
		if (! ~ `{cat $D/2/body | rot13 | tcs -f microsoft | grep 'RCPT TO:.*MAIL.*HELO'} '' ) virus=yes
	}

	if (grep -si '\.zip' $D/2/filename >[2]/dev/null)
		if (! ~ `{unzip -sc < $D/2/body | rot13 | grep 'Version\\Explorer'} '' ) virus=yes
		if (! ~ `{unzip -cs < $D/2/body | rot13 | tcs -f microsoft | grep 'RCPT TO:.*MAIL.*HELO'} '' ) virus=yes
	}

	if(~ $virus yes)
		status=''
	if not
		status='not this virus'
}