Re: Regex to block Sobig

[Danny Sauer <cloudmaster@cloudmaster.com>]

Danny Sauer wrote:
> Steven Pritchard wrote:
> 
>> On Fri, Aug 22, 2003 at 11:49:32AM -0500, Marcelo Medici wrote:
>>
>>> i am trying to filter, using procmail, the offending subjects created in
>>> email by the sobig worm.
> 
> My postfix header_filters setup is also using this
> 
> /^Subject: (Re: (Details|Approved|Re: My details|That movie|Wicked 
> screensaver|Your application)|Your details) *$/    REJECT Sorry, the 
> subject of your message implies that you are the sobig.f virus.

Sorry - I meant to use "DISCARD" and not "REJECT" - since those have 
forged From: headers anyway, and I don't need to contribute to the 
bandwidth problem that sobig's creating...  DISCARD still logs the 
result, though, so I can keep track of whose mail's getting trashed.

--Danny


-
To unsubscribe, send email to majordomo@luci.org with
"unsubscribe luci-discuss" in the body.