FriendlyGreeting is Expanding

[Julian Field]

At 16:28 13/11/2002, you wrote:
>I am ready to just block all e-mail.

Do that and I'll have to go back to collecting things (glasses, clocks,
bottles of brandy...)
:-)

>I attached the two possibilitys now according to Mcafee.  Does anybody
>have a long term solution for these guys.  I believe the rule that
>Julian suggested adding to spam.assassin.prefs.conf only covers the
>first one.

I have only seen these two. The second one appeared last week. Updates for
sendmail.cf or spam.assassin.prefs.conf are included here for everyone's
benefit. If I hear any more news in this I'll let you all know.

Stop them in sendmail:

HSubject: $>Check_Subject
D{FriendPat1}you have an E-Card from
D{FriendPat2}you have a greeting card from
D{FriendMsg}This message is probably a nasty E-Card.
SCheck_Subject
R$* ${FriendPat1} $*            $#error $@ 5.7.1 $: ${FriendMsg}
R$* ${FriendPat2} $*            $#error $@ 5.7.1 $: ${FriendMsg}

Or stop them in SpamAssassin:

header   FRIEND_GREETINGS       Subject =~ /you have an E-Card from/i
describe FRIEND_GREETINGS       Nasty E-card from FriendGreetings.com
score    FRIEND_GREETINGS       100.0
header   FRIEND_GREETINGS2      Subject =~ /you have a greeting card from/i
describe FRIEND_GREETINGS2      Nasty E-card from FriendGreetings.com
score    FRIEND_GREETINGS2      100.0

--
Julian Field                Teaching Systems Manager
jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                             Southampton SO17 1BJ