procmail
[Top] [All Lists]

Re: The latest epidemic

2001-07-24 06:44:50
Ya know, this may be a little inappropriate to say, but I'm kinda diggin the worm..

I had no idea so many people were visiting our websites.  :)

- md

At 08:20 AM 7/24/2001 -0500, Christopher P. Lindsey wrote:
> Hi! How are you?
>
> I send you this file in order to have your advice
>
> See you later. Thanks
>
> So I guess the challenge is to identify how to grab the email and toss it if
> those words exist, *and in that exact combination seen above*
> This is regexp hell for me. I still can't make any headway with this subject
> despite copious reading over the past couple of years.

Hi Colin,

Here's a simplified version of what I've been using, for better or worse:

:0
* B ?? ^Hi! How are you=3F$.*$I send you this file in order to have your advice$.*$See you later=2E Th
anks
/dev/null

We actually send an auto-response back to the user with pointers to
McAfee and Symantec for this particular worm, but the above should be good
enough for basic filtering...

Chris
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail


_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>