On Mon, 29 Sep 2003 20:16:54 GMT, Larry wrote:

On Mon, 29 Sep 2003 18:13:52 GMT, Doug Kanter wrote:

The SWEN-laden messages I'm getting have so far come from 218 different
addresses. How does Mailwasher deal with this? Seems to complicated for a
blacklisting scheme.

Actually, it is done using regex expressions, it doesn't rely on from
addresses at all. In MailWasher you set a filter to follow two rules:

The entire header contains RegExp Content-Type:
multipart/(mixed|alternative)

and

The entire header contains RegExp boundary\="([a-z][a-z]*)"

Try it.

I got that from a post by Ralph Fox. He uses this filter in Agent:

Content-Type: =%{multipart/(mixed|alternative); boundary="[a-z][a-z]*"}

which also works well.



"Larry" wrote in message
...
On 27 Sep 2003 19:46:34 -0500, noah wrote:

I received a message today, in Portuguese no less, listing my email
address, and a number of others in this group, as having been
harvested by the W32/swenn@mm worm.

...snip

I'm a newbie here, but not having seen mention of them, you folks should
be
aware of a few programs which will help. Pop3ScanMail and MailWasher will
allow you to delete these on your server without first having to download
them. I use MailWasher Pro which allows blacklisting, whitelisting and
filters to help you automate these tasks. I'm using a filter for Swen
which is about 99% effective. Saves a LOT of time.
--

Larry
email is rapp at lmr dot com



--
Larry- Thanks for this, I use Agent. I'll still need to visit the ISP
to dump the Viro-mail tho'.
....carry on.
noah

To email me, please remove the "FISH" from the net.