On Thu, 25 Sep 2003 19:19:59 -0400, Chris Tucker wrote:
>>Does Eudora have RegExp?
>
>I've no idea whatsoever.

In the Windoze version, when you bring up the filter editor, it gives you choices such 
as Matches, Starts with, Contains, and so on. If one is Matches RegExp (or Regular 
Expressions), you're in. Mine has two, one is case sensitive. (Use the 
case-insensitive one.) Seems to me that it wasn't in there when I first bought Eudora, 
and I have no idea how the Mac and Windoze versions compare for features, but I 
thought I'd mention it.

That worm only has a few fields you need to try to match, and there are only a few 
different terms in each field. Building a complete set of matching filters for all the 
permutations would be a pain in the neck at best, but RegExp will let you match all 
the permutations simply by listing all the terms and tying them together with some 
logic. Between them, those four filters (http://www.nonken.net/swen/#RegExp) have 
snagged every SWEN message that's come in, and I haven't seen a single false positive 
in three days of monitoring.

I personally recommend using a separate, throw-away address for newsgroup posting. 
This worm is a classic example: from everything I've heard, nearly every copy of these 
messages received have been to accounts that post on the newsgroups. And the patterns 
indicate we're actually being deliberately spammed, not hit by infected systems.

It's been and is being discussed extensively in alt.spam and alt.stop.spamming, among 
other places.

-----
Jeffrey J. Nonken
http://jnork.nonken.net/


--
PCI-PowerMacs is sponsored by <http://lowendmac.com/> and...

 Small Dog Electronics    http://www.smalldog.com  | Refurbished Drives |
 -- Sonnet & PowerLogix Upgrades - start at $169   |  & CDRWs on Sale!  |

      Support Low End Mac <http://lowendmac.com/lists/support.html>

PCI-PowerMacs list info: <http://lowendmac.com/lists/pci-powermacs.shtml>
  --> AOL users, remove "mailto:";
Send list messages to:   <mailto:[EMAIL PROTECTED]>
To unsubscribe, email:   <mailto:[EMAIL PROTECTED]>
For digest mode, email:  <mailto:[EMAIL PROTECTED]>
Subscription questions:  <mailto:[EMAIL PROTECTED]>
Archive:<http://www.mail-archive.com/pci-powermacs%40mail.maclaunch.com/>

Using a Mac? Free email & more at Applelinks! http://www.applelinks.com

Reply via email to