Re: Spam & Junk email - what to do?

[Phoenyx <quazar@dcnet-20-00.com>]

On Fri, 19 Sep 2003 14:02:16 GMT
"Stephen Hartz" <SHartz@columbus.rr.com> wrote:

> This may be a little off topic here, but as a regular here  I'm
> going to post it anyway.  I keep getting JUNK  emails 'security
> updates', etc , on Outlook Express, which I use to access comp.sys
> apple2 .  Is there a way to block this stuff???

A few comments... Make sure to obfuscate you email address in the newsgroups. I had been away for quite a while and when I setup the newsgroups, I forgot this step. Besides the standard method this worm uses via MS Outlook, the distributors are also using spambots with whatever email addresses they can gather wherever. Newsgroups are primary targets. I quickly fixed the email address but it may be a while before the attacks stop. They have slowed though and I think I've managed to get my Sylpheed-claws filtering to catch all the variants (all I've been getting) without interfering too much with my regular email.

The following filter rule seems to catch the majority. Perhaps it might help someone else.

---

headers_part matchcase "skynet.be" | from matchcase "Microsoft" | subject matchcase "Microsoft" | from matchcase "ms corporation" | from matchcase "ms technical" | from matchcase "ms public" | from matchcase "ms net" | from matchcase "ms security" | from matchcase "ms internet" | from matchcase "ms message" | from matchcase "ms mail" | from matchcase "internet message" | from matchcase "internet security" | from matchcase "inet delivery" | from matchcase "inet messag" | from matchcase "inet email delivery" | from matchcase "inet service" | from matchcase "network system" | from matchcase "network email" | from matchcase "network delivery" | from matchcase "net upgrade" | from matchcase "net storage" | from matchcase "net email" | from matchcase "customer support" | subject matchcase "security support" | subject matchcase "security update" | subject matchcase "Returned Message" | subject matchcase "Returned Mail" | subject matchcase "critical patch" | subject matchcase "failure message" | subject matchcase "abort report" | subject matchcase "bug notice" | subject matchcase "critical update" | subject matchcase "undelivered mail: return" | subject matchcase "undeliverable message: user" | from matchcase "administrator" | from matchcase "admin" | from matchcase "network mail delivery" | from matchcase "postmaster" | from matchcase "email storage" | from matchcase "robot@america.com" | subject matchcase "mail user unknown" | subject matchcase "failure announcement" | subject matchcase "failure advice" | from matchcase "program security" | from matchcase "value valet" | from matchcase "tex ritter" | all

----

In the end, it doesn't matter who is affected by the worm itself as it affects everyone who has to deal with filtering it and the bandwidth it wastes with there connection. Based on the barrage of hits which so many people are getting, I expect this internet flooding is part of the designers intent.

-- 
Cheers,
Phoenyx

    Ain't nothing like the clasics!
    Apple2 user since March 1984
    -={ Apple II Forever }=-

    Phoenyx' Apple II page
    http://www.dcnet2000.com/~quazar/Apple2