On Wed, 24 Sep 2003, Peter Busser <[EMAIL PROTECTED]> wrote: > I use several procmail rules to filter out domains (microsoft.com, > msdn.com, etc.) in From: and From, To: (e.g. microsoft.com) and certain > words in the subject (e.g. Microsoft). Since the virus depends on > looking like an authentic message, it can't do too much randomisation of > the domains and subject lines. Of course the filtering is not perfect, > but it still reduces the number of virus messages hitting the inbox.
Someone pointed out yesterday that Swen has the header "SUBJECT: " in all upper-case, as opposed to the usual mixed-case "Subject: ". I looked at all the ones I've received, and sure enough, they're all upper-case. That might be another telltale you can use if you're taking the procmail approach. -- Brent J. Nordquist <[EMAIL PROTECTED]> N0BJN Other contact information: http://kepler.acns.bethel.edu/~bjn/contact.html * Fast pipe * Always on * Get out of the way - Tim Bray http://tinyurl.com/7sti _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
