SCOUG-HELP Mailing List Archives

<< Previous Message << >> Next Message >>

Date:	Wed, 24 Sep 2003 12:28:50 PDT7
From:	"Steven Levine" <steve53@earthlink.net >
Reply-To:	scoug-help@scoug.com
To:	scoug-help@scoug.com
Subject:	SCOUG-Help: Swen virus - filtering the messages (was: Rejected messages that I never sent)

=====================================================
If you are responding to someone asking for help who
may not be a member of this list, be sure to use the
REPLY TO ALL feature of your email program.
=====================================================

In <3F71EBEB.563D@peterskye.com>, on 09/24/03
at 12:07 PM, Peter Skye said:

>I've gotten enough of these things to recreate the Subject table they're
>randomly generated from. (My email client doesn't allow filtering on the
>message body which is the easy way to do it.)

I can do body searches, but I don't want to absorb the time hit.

>The filter I'm testing right now looks at the last two words of the
>Subject line which Swen takes randomly from two tables.

>Filtering the bouncebacks from spoofed From lines using any of my own
>email addresses is trickier; I don't have a filter for those yet (if I
>could just filter on message size then I could catch them).

My standard filters caught most of swen messages, because they have odd
looking To: fields.

I added the quickie:

{F}((MS|MICROSOFT) CORPORATION) & !{F}"@MICROSOFT.COM>"

which caught most of the rest. I'll probably tweak it a bit based on your
word list if the rate does not subside by the weekend. I've only got 9
instances that my existing filters do not catch.

Steven

--
----------------------------------------------------------------------
"Steven Levine" MR2/ICE 2.37 #10183 Warp4/FP15/14.093c_W4
www.scoug.com irc.webbnet.info irc.fyrelizard.org #scoug (Wed 7pm PST)
----------------------------------------------------------------------

=====================================================

To unsubscribe from this list, send an email message
to "steward@scoug.com". In the body of the message,
put the command "unsubscribe scoug-help".

For problems, contact the list owner at
"rollin@scoug.com".

=====================================================

Return to [ 24 | September | 2003 ]

SCOUG, Warp Expo West, and Warpfest are trademarks of the Southern California OS/2 User Group. OS/2, Workplace Shell, and IBM are registered trademarks of International Business Machines Corporation. All other trademarks remain the property of their respective owners.