Date: Thu, 18 Sep 2003 22:33:26 -0500 From: Kirk Strauser <kirk@strauser.com> To: freebsd-stable@freebsd.org Subject: Sieve script to filter today's MS annoyances Message-ID: <87fzitqwop.fsf@strauser.com>
next in thread | raw e-mail | index | archive | help
--=-=-=
Content-Transfer-Encoding: quoted-printable
I don't know what's going on, but I've been getting literally hundreds of
virus/worm-looking emails per hour all day today. I grew tired of it and
wrote the following Sieve script to filter my mail on the server.
The pseudo-bounce messages were particularly annoying; they're close enough
to the real bounce messages that I *want* to keep that they justified a
little closer examination. I'll probably tighten the other message type to
also examine the sender, but I doubt I'll be getting any legitimate mails
that look like:
Subject: latest security patch
in the near future. Anyway, enjoy as you see fit.
############################################################
#### Virus detection
# 2003-09-18: Something stupid and Microsofty
if anyof(
# This one is super-annoying; it mimics real bounce messages
allof(
header :matches "From" [
"email*",
"internet*",
"microsoft*",
"ms*" ],
header :matches "From" [
"*service",
"*system"
],
header :is "Subject" [
"abort advice",
"abort letter",
"Error Notice",
"mail: user unknown",
"Returned Mail",
"returned message" ]
),
# "Current Security Pack", "New Security Update", etc.
allof(
header :matches "Subject" [
"current*",
"last*",
"latest*",
"microsoft*",
"new*",
"newest*" ],
header :matches "Subject" [
"*upgrade",
"*update",
"*pack",
"*patch" ]
)
)
{
fileinto "INBOX.virus.2003-09-18";
}
############################################################
=2D-=20
Kirk Strauser
The Strauser Group
Open. Solutions. Simple.
http://www.strausergroup.com/
--=-=-=
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
iD8DBQA/ankG5sRg+Y0CpvERAp8IAJ41w0Ah71lej00i5pjK9tUIOgxrsACdEoPX
rrCyH5pc+LhRNOsA9zspDtQ=
=goTF
-----END PGP SIGNATURE-----
--=-=-=--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?87fzitqwop.fsf>