Re: OT - worm problem
I have tried to implement such a scheme with an exim system filter... but
strangely enough it only *sort of* works... about half of the emails come
through... or if i wait long enough it seems like all of them do...(but only
on weekdays? :) )
has anyone put together some exim-style rules for filtering swen-related
junk?
dylan
on 03.10.28 1:46 PM, christophe barbe at christophe@cattlegrid.net was
reported to have writen:
> On Tue, Oct 28, 2003 at 12:27:27PM -0800, Johnathon Jamison wrote:
>> What is the chance that email addresses in the archives could be
>> modified to say something like
>> * From: Zach Archer <chaz (at) dslnorthwest.net>
>> instead of
>> * From: Zach Archer <chaz@dslnorthwest.net>
>> so the email address spiders do not get them? I think this may help in
>> the future (but will do nothing for the past).
>
> 0. Your email address is grabbed by the worm (swen) on a newsgroup
> gateway. So the problem is not the archive. And in anycase trying to
> protect you address would only bother real people not worm/spammers.
>
> Concerning swen, I use the following procmail rules:
>
> :0
> * -2^0
> * 1^0 > 140000
> * 1^0 < 165000
> * 1^0 ^subject: (undeliverable|undelivered|returned)? ?(mail|message)(:?
> (returned to (mail|send)er|user unknown))?
> * 1^0 ^subject: (new(est)?|latest|last|current)?
> ?(net(work)?|microsoft|internet)? ?(critical|security)?
> * ?(pack|patch|update|upgrade)
> * 1^0 ^subject: (abort|bug|error|failure)?
> * ?(advice|announcement|letter|message|notice|report)
> {
> :0 BD
> * b3IAAABBZG1pbgAAAEdFVCBodHRwOi8vd3cyLmZjZS52dXRici5jei9iaW4vY291bnRlci5naWYv
> /dev/null
> }
>
> :0
> * > 140000
> * < 165000
> *^subject: *$
> {
> :0 BD
> * b3IAAABBZG1pbgAAAEdFVCBodHRwOi8vd3cyLmZjZS52dXRici5jei9iaW4vY291bnRlci5naWYv
> /dev/null
> }
>
> which are simples and very effectives.
>
> Christophe
--
"The world is a dangerous place to live; not because of the people who are
evil, but because of the people who don't do anything about it."
-Albert Einstein
Reply to: