procmail
[Top] [All Lists]

RE: Problem with MS "update" spam

2005-05-24 16:33:53
At 17:44 2005-05-24 -0500, Pettit, Paul wrote:

The Content-type is in the header as far as I can tell but I'll double check
that.

'application' in the header seems a bit queer - there'd be at least the text portion, no? 'application' would be appropriate to the content-type header for an individual mime chunk.

Interesting. I didn't consider that. I'll remve the ';' and see if that
fixes it. One can only hope it's that simple.

Note that flakey MIME is a common trait for spam and malware.

> Have you considered taking one of the failed messages and
> throwing it at
> your recipe with VERBOSE=ON and then checking the logfile?
>

Yes I've been running with VERBOSE=ON and loging since earlier today but I
have not gotten another spam like it yet to compare with.

Well, the idea would be to make a copy of your mail ON the server:

:0c
backup.mbx


Generally, one would do this near the top of an rcfile containing untested recipies in a live mail config (er, that's what people should use a sandbox for though), but if you're simplty preprocessing mail before you retrieve it with a POP/IMAP client, this sort of recipe will preserve a copy of the messages so you can view them in their original form. In that case, you might want to do it just before the delivery recipe (after things which discard messages), so that it is merely a backup of the delivered mail, not a backup of everything, including stuff identified as cruft. Though, you might want to save it all anyway.

Many of the procmail users are using *nix mail clients, or at least preserving a copy of their mail on the mail server (which is what I do, even though I use a windows based MUA).

I'll try that but we don't save copies of emails on the server and it's a
POP3 server setup so I don't know I have one till I've downloaded it and
then it's not on the server anymore.

See above. If you're running procmail, and you have shell access, you should be able to store copies of messages local to the mailhost (and separate from your POP mailbox).

---
 Sean B. Straw / Professional Software Engineering

 Procmail disclaimer: <http://www.professional.org/procmail/disclaimer.html>
 Please DO NOT carbon me on list replies.  I'll get my copy from the list.


____________________________________________________________
procmail mailing list   Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>