View Single Post
  #19   Report Post  
Larry
 
Posts: n/a
Default Virus Update- Is your name on the list?

On Mon, 29 Sep 2003 21:15:14 GMT, Peggie Hall wrote:

Larry wrote:
Actually, it is done using regex expressions, it doesn't rely on from
addresses at all. In MailWasher you set a filter to follow two rules:

The entire header contains RegExp Content-Type:
multipart/(mixed|alternative)

and

The entire header contains RegExp boundary\="([a-z][a-z]*)"

Try it.


Would you mind explaining that to me in English? 'Cuz from your
example, it appears to me that would filter out everything. And why
would you use a filter instead of a wildcard on the blacklist?

If you want to move the lesson to email, my address is
.

Peggie
----------
Peggie Hall
Specializing in marine sanitation since 1987
Author "Get Rid of Boat Odors - A Guide To Marine Sanitation Systems and
Other Sources of Aggravation and Odor"
http://www.seaworthy.com/html/get_ri...oat_odors.html


Hi Peggie,

Well, if you've tried it, you know that it won't filter everything. In
fact, it only filters Swen. Unfortunately, it doesn't work on all of them,
but here it gets about 98%. The reason I use a filter rather than a
blacklist is that this thing is temporary (at least I hope it is) and it is
constantly changing. You can have the filter add the address to the
blacklist if you like, but I doubt it will help much.

As for how it works, first I have to say that it isn't my work - I learned
of it from Ralph Fox on alt.usenet.offline-reader.forte-agent. Basically,
what he (or someone else) did was to note that all of the Swen posts were
coded as having a content type of either multipart/alternative or
multipart/mixed. The second thing is that their boundary is always
specified as multi-character string of two or more characters. The two
regex expressions in the filters - Note: you must couple the two rules with
an "and" - handles this.

Hope this helps. If not, ask away.

--

Larry
email is rapp at lmr dot com