As you might guess, this has been discussed recently on the SpamAssassin list. It appears the simplest rule is a header check (which could also be done in the MTA):
header GERMANSPAM MESSAGEID =~ /^<[EMAIL PROTECTED]>/ describe GERMANSPAM Contains German Spam score GERMANSPAM 20
You can add this to your local.cf file.
Valid qmail message ids do not contain lowercase letters. There are also rules that match the various subjects, but the subject line is changing as the email is propagated via a virus/worm.
-Bill
Chris Masters wrote:
Hi All,
We were hit by this today [in the UK]:
http://www.theregister.co.uk/2004/06/11/german_hate_mail_virus/
We're thinking that the best approach is to write a SpamAssassin rule.
Any other ideas?
Thanks, Chris
__________________________________
Do you Yahoo!?
Friends. Fun. Try the all-new Yahoo! Messenger.
http://messenger.yahoo.com/ _______________________________________________
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
_______________________________________________ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
