Whoever wrote this one is either a moron, or very smart and specifically making it easy for Unix users to ignore his email. (He's still wasting my bandwidth, so I still don't like him, but, well, if that virus was written with exactly this procmail rule in mind, more power to him, and I hope others follow along.)
The virus seems to always produce /^SUBJECT:/ in the header in place of /^Subject:/. To my knowledge, no real MUA does this. (I went and checked a fair sampling of mail from people I want to continue getting mail from, and none of them had this broken header.)
That gives us this:
:0 HD: # only check the header, case matters
* ^SUBJECT:
spam
Works like a charm.
I've also bumped the MICROSOFT_EXECUTABLE in my SpamAssassin config up to 2.5 (and may just take it clean up to double-digits), but that's a bit more clumsy if you actually want to receive email with executables in it.
Post a Comment