From owner-freebsd-stable@FreeBSD.ORG Sun Sep 21 08:00:33 2003 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A9AA316A4C0 for ; Sun, 21 Sep 2003 08:00:33 -0700 (PDT) Received: from rusunix.org (rusunix.org [195.162.58.254]) by mx1.FreeBSD.org (Postfix) with ESMTP id E81F243FDD for ; Sun, 21 Sep 2003 08:00:32 -0700 (PDT) (envelope-from aquatique@rusunix.org) Received: by rusunix.org (CommuniGay Pro, from userid 1111) id 6D1041CBB41; Sun, 21 Sep 2003 22:00:30 +0700 (OMSST) From: "Evgueni V. Gavrilov" To: freebsd-stable@FreeBSD.ORG In-Reply-To: <200309191729.h8JHTDal019393@lurza.secnetix.de> X-Newsgroups: freebsd.stable User-Agent: tin/1.6.1-20030810 ("Mingulay") (UNIX) (FreeBSD/4.9-PRERELEASE (i386)) Message-Id: <20030921150030.6D1041CBB41@rusunix.org> Date: Sun, 21 Sep 2003 22:00:30 +0700 (OMSST) Subject: Re: Sieve script to filter today's MS annoyances X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Sep 2003 15:00:33 -0000 In article <200309191729.h8JHTDal019393@lurza.secnetix.de> of freebsd.stable group you wrote: OF> I got lots of those, too. From looking at the headers, OF> there didn't seem to be very reliable things to identify OF> that crap, so i decided to filter by body. this solution could be inappropriate on mail hubs with thousand accounts, because the body of the virus should be received in order to check it I found that Subject withing headers written by capital chars (i.e. SUBJECT:) and use it in order to identify the virus (yes, I don't care about ancient MTAs ;-) -- http://aquatique.rusunix.org