E-mail filter for Novarg/MyDoom/MiMail.R

  • Thread starter Thread starter Zvi Netiv
  • Start date Start date
Z

Zvi Netiv

For who uses MMM3 or MailWasher, here is a simple rule to filter out Novarg:

Header contains "Content-Type: multipart/mixed"

AND

Header contains "boundary="----=_NextPart_000_"

(omit the quote marks).

Regards, Zvi
 
For basic content filtering server side -

IF (subject = hi OR Hello OR error OR Mail Delivery System OR Mail
Transaction Failed OR Server report OR status)
AND IF (body text = contains unicode characters AND binary attachment OR
7-bit ASCII encoding AND binary attachment OR Mail transaction failed.
Partial message available.)
THEN
DELETE / MOVE / etc....

RnBP
 
John Smith said:
For basic content filtering server side -

IF (subject = hi OR Hello OR error OR Mail Delivery System OR Mail
Transaction Failed OR Server report OR status)
AND IF (body text = contains unicode characters AND binary attachment OR
7-bit ASCII encoding AND binary attachment OR Mail transaction failed.
Partial message available.)
THEN
DELETE / MOVE / etc....
Click to expand...

Tried that, didn't catch all instances of Novarg. Besides, there is a
limitation of just two conditions per filter in MMM3 (open source, and free),
while your first IF has six OR'ed arguments.

Cheers, Zvi
 
Back
Top