Anti spam solutions

[Chris F.A. Johnson]

On Wed, 8 Oct 2003, William Park wrote:

> On Wed, Oct 08, 2003 at 01:06:16AM -0400, Chris F.A. Johnson wrote:
> > ^FROM:.*\<MS\> [a-z][a-z]
> > ^From:.*Microsoft.*
> > ^From:.*Inet
> > ^From:.*Internet
> > ^From:.*Security Division
> > ^Subject:.*New Internet Critical Pack
> > ^To:.*client@
> > ^Virus detected
> > ^(To|Cc):.*Network Client
> > ^(To|Cc):.*receiver
> > ^(To|Cc):.*recipient
> > ^(To|Cc):.*user
> > ^(To|Cc):.*Client
> > ^(To|Cc):.*Customer
> > ^(To|Cc):.*Inet Receiver.*
> > ^(TO|Cc):.*Internet
> > ^Content-Type:.*name=.*(.scr|.exe|.pif|.com|.bat)
> > (Cumulative|Network|Critical).*Patch
>
> I found that just
>     :0HB
>     * ^Content-Type: (audio/(x-wav|x-midi)|application/x-msdownload)
> in ~/.procmailrc covers all spams of recent interest.

     That would probably take care of it in my script, too; the main
     reason for not using procmail is to prevent having to download
     multimegabytes every hour.

     Another program that delete at the source is mailfilter:

       <http://mailfilter.sourceforge.net/>

     Unfortunately, it only reads the headers, and I found that the
     most reliable block was in the top 10 to 20 lines of the body (as
     also shown by your solution), so I wrote the script. The regex
     files do need tuning.

-- 
	Chris F.A. Johnson
	=================================================================
	cfaj-uVmiyxGBW52XDw4h08c5KA at public.gmane.org                      http://cfaj.freeshell.org
--
The Toronto Linux Users Group.      Meetings: http://tlug.ss.org
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml