In article <0da701c38478$48af0f00$(E-Mail Removed)>, "Louieizme"
<(E-Mail Removed)> wrote:
>good thing is that filters wont work because the emails
>are randomly generated.
Not necessarily - a quick check through my email suggests that the From
addresses are generated using a simple rule based on the following:
Pick a number from one to four.
1. Choose from {Admin,Administrator,Microsoft,Postmaster}
2. Choose and concatenate from {,{ms,microsoft} {,corporation}}
{,internet,network} {customer,public,security,technical}
{assistance,bulletin,services,support}
e.g. "MS Corporation Internet Customer Assistance".
3. Choose and concatenate from {,microsoft,ms} {,inet,internet,net,network}
{,email,mail,message} {,delivery,storage} {service,system}
e.g. "MS Internet delibery system"
4. Choose and concatenate from {,microsoft corporation,ms}
{,internet,network,program} security {center,department,division,section}
There's a similarly short list of rules for the subject line.
Then there are key phrases in the message itself. If you really feel a need
to filter with a seriously small percentage of rejections, you can analyse
the emails you receive - or analyse the virus itself - and build a filter
that will be almost certain to only ever reject the virus. Me, I sort by
subject, and hit "Delete" on the ones I recognise as viral. I get through a
thousand or so every day (because I used to transfer them to a holding pen
first).
Alun.
~~~~
[Please don't email posters, if a Usenet response is appropriate.]
--
Texas Imperial Software | Find us at
http://www.wftpd.com or email
1602 Harvest Moon Place |
(E-Mail Removed).
Cedar Park TX 78613-1419 | WFTPD, WFTPD Pro are Windows FTP servers.
Fax/Voice +1(512)258-9858 | Try our NEW client software, WFTPD Explorer.