Re: mymail worm
On Wed, Feb 04, 2004 at 08:24:52PM -0500, Wayne Topa wrote:
> Brian Potkin(brian@copernicus.demon.co.uk) is reported to have said:
> >
> > Its usefulness in deleting spam and mail associated with the mymail worm
> > before downloading it has been offset by the deletion of a small number
> > of legitimate mails, including one a few minutes ago. The originating
> > mail server should have added a Message-Id but for some reason some
> > don't. Effective the rule might have been but I'd rather not lose mail.
> >
>
> So use the rule with SCORE instead of DENY. If it's ligit mail other
> score rules will let it pass.
>
> I have yet to see any ligit mail get through (and I check daily) in
> well over 3 months of use.
Thanks for reminding me of SCORE; I'll try combining a Message-Id: rule
with some other header characteristic of mymail worm mails, perhaps To:.
If it were possible to formulate independent sets of SCORE rules in
mailfilter it would make the task easier.
Brian.
Reply to: