Re: OT - worm problem
On Tue, Oct 28, 2003 at 12:27:27PM -0800, Johnathon Jamison wrote:
> What is the chance that email addresses in the archives could be
> modified to say something like
> * From: Zach Archer <chaz (at) dslnorthwest.net>
> instead of
> * From: Zach Archer <chaz@dslnorthwest.net>
> so the email address spiders do not get them? I think this may help in
> the future (but will do nothing for the past).
0. Your email address is grabbed by the worm (swen) on a newsgroup
gateway. So the problem is not the archive. And in anycase trying to
protect you address would only bother real people not worm/spammers.
Concerning swen, I use the following procmail rules:
:0
* -2^0
* 1^0 > 140000
* 1^0 < 165000
* 1^0 ^subject: (undeliverable|undelivered|returned)? ?(mail|message)(:? (returned to (mail|send)er|user unknown))?
* 1^0 ^subject: (new(est)?|latest|last|current)? ?(net(work)?|microsoft|internet)? ?(critical|security)?
* ?(pack|patch|update|upgrade)
* 1^0 ^subject: (abort|bug|error|failure)?
* ?(advice|announcement|letter|message|notice|report)
{
:0 BD
* b3IAAABBZG1pbgAAAEdFVCBodHRwOi8vd3cyLmZjZS52dXRici5jei9iaW4vY291bnRlci5naWYv
/dev/null
}
:0
* > 140000
* < 165000
*^subject: *$
{
:0 BD
* b3IAAABBZG1pbgAAAEdFVCBodHRwOi8vd3cyLmZjZS52dXRici5jei9iaW4vY291bnRlci5naWYv
/dev/null
}
which are simples and very effectives.
Christophe
--
Christophe Barbé <christophe.barbe@ufies.org>
GnuPG FingerPrint: E0F6 FADF 2A5C F072 6AF8 F67A 8F45 2F1E D72C B41E
L'experience, c'est une connerie par jour mais jamais la même.
Reply to: