With the latest worm swamping everyone, I thought those of you who use procmail might find this useful. I came across it the other day, it contains a whole bunch of procmail mumbo jumbo (is there a program with a worst config file than procmail) that I don't understand, but it appears to be very effective at spotting these worms.

http://www.spamless.us/pub/procmail/virussnag.rc