SCOUG-HELP Mailing List Archives

<< Previous Message << >> Next Message >>

Date:	Wed, 24 Sep 2003 12:07:34 PDT7
From:	Peter Skye <pskye@peterskye.com >
Reply-To:	scoug-help@scoug.com
To:	scoug-help@scoug.com
Subject:	SCOUG-Help: Swen virus - filtering the messages (was: Rejected messages that I never sent)

Content Type: text/plain

=====================================================
If you are responding to someone asking for help who
may not be a member of this list, be sure to use the
REPLY TO ALL feature of your email program.
=====================================================

Steven Levine wrote:
>
> The subjects are what they are to deceive

I've gotten enough of these things to recreate the Subject table they're
randomly generated from. (My email client doesn't allow filtering on
the message body which is the easy way to do it.)

The filter I'm testing right now looks at the last two words of the
Subject line which Swen takes randomly from two tables.

The next-to-last Subject word is any of:

Email
Public
Security
Technical

and the following (last) Subject word is any of:

Assistance
Bulletin
Center
Department
Section
Service
Services
Support

The above two tables yield 32 different Subject strings to filter on.

You can't filter on Subject words before the last two since those tables
contain a null as one possibility, hence there's nothing to filter on.

Filtering the bouncebacks from spoofed From lines using any of my own
email addresses is trickier; I don't have a filter for those yet (if I
could just filter on message size then I could catch them).

- Peter

=====================================================

To unsubscribe from this list, send an email message
to "steward@scoug.com". In the body of the message,
put the command "unsubscribe scoug-help".

For problems, contact the list owner at
"rollin@scoug.com".

=====================================================

Return to [ 24 | September | 2003 ]

SCOUG, Warp Expo West, and Warpfest are trademarks of the Southern California OS/2 User Group. OS/2, Workplace Shell, and IBM are registered trademarks of International Business Machines Corporation. All other trademarks remain the property of their respective owners.