Sieve script to filter today's MS annoyances

[Michael W. Oliver]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

+--- On Thursday, September 18, 2003 23:33 ---
| Kirk Strauser proclaimed:
|
| I don't know what's going on, but I've been getting literally hundreds of
| virus/worm-looking emails per hour all day today.  I grew tired of it and
| wrote the following Sieve script to filter my mail on the server.
|
| The pseudo-bounce messages were particularly annoying; they're close
| enough to the real bounce messages that I *want* to keep that they
| justified a little closer examination.  I'll probably tighten the other
| message type to also examine the sender, but I doubt I'll be getting any
| legitimate mails that look like:
|
|     Subject: latest security patch
|
| in the near future.  Anyway, enjoy as you see fit.
|

I have found the following line in my Postfix body_checks.regexp to be very 
satisfying:

/^TVqQAAMA/	REJECT	Sorry, no executables allowed... zip it up.

Googling for that eight character string revealed it as the common 
denominator for win32 execs.

- -- 
Mike
perl -e 'print unpack("u","88V]N=&%C=\"!I;F9O(&EN(&AE861E<G,*");'


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (FreeBSD)

iD8DBQE/a3mesWv7q8X6o8kRAlV1AJ9g78cT1iR294hs/vwDW+NdOuR6SACeIrxU
Ax2GZhA5QWPa8vRiMz16qhk=
=EiP+
-----END PGP SIGNATURE-----