FriendlyGreeting is Expanding

[Steve Evans]

Basically the difference between blocking them in Sendmail or
SpamAssassin is the amount of work the server does, and if you want more
control on what happens to the message.  So SpamAssassin allows you to
re-direct for example, sendmail just bounces.

Steve Evans
SDSU Foundation
(619) 594-0653 

-----Original Message-----
From: Julian Field [mailto:mailscanner at ECS.SOTON.AC.UK] 
Sent: Wednesday, November 13, 2002 10:53 AM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: FriendlyGreeting is Expanding


At 16:28 13/11/2002, you wrote:
>I am ready to just block all e-mail.

Do that and I'll have to go back to collecting things (glasses, clocks,
bottles of brandy...)
:-)

>I attached the two possibilitys now according to Mcafee.  Does anybody 
>have a long term solution for these guys.  I believe the rule that 
>Julian suggested adding to spam.assassin.prefs.conf only covers the 
>first one.

I have only seen these two. The second one appeared last week. Updates
for sendmail.cf or spam.assassin.prefs.conf are included here for
everyone's benefit. If I hear any more news in this I'll let you all
know.

Stop them in sendmail:

HSubject: $>Check_Subject
D{FriendPat1}you have an E-Card from
D{FriendPat2}you have a greeting card from
D{FriendMsg}This message is probably a nasty E-Card. SCheck_Subject
R$* ${FriendPat1} $*            $#error $@ 5.7.1 $: ${FriendMsg}
R$* ${FriendPat2} $*            $#error $@ 5.7.1 $: ${FriendMsg}

Or stop them in SpamAssassin:

header   FRIEND_GREETINGS       Subject =~ /you have an E-Card from/i
describe FRIEND_GREETINGS       Nasty E-card from FriendGreetings.com
score    FRIEND_GREETINGS       100.0
header   FRIEND_GREETINGS2      Subject =~ /you have a greeting card
from/i
describe FRIEND_GREETINGS2      Nasty E-card from FriendGreetings.com
score    FRIEND_GREETINGS2      100.0

--
Julian Field                Teaching Systems Manager
jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                             Southampton SO17 1BJ