You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@spamassassin.apache.org by Justin Mason <jm...@jmason.org> on 2006/07/06 20:05:45 UTC

Re: Braindead worms

John D. Hardin writes:
> FYI, a couple of headers the executable-attachment filters trapped
> today on a system I assist with:
> 
> > From ws3@netshelter.adtrix[2].txt  Thu Jul  6 10:36:55 2006
> > Return-Path: <ws3@netshelter.adtrix[2].txt>
> 
> > From drive\windows\cookies\ws3@tripod[1].txt  Thu Jul  6 10:36:51
> 2006
> > Return-Path: <drive\windows\cookies\ws3@tripod[1].txt>
> 
> ...sigh.
> 
> Is it worth a rule to catch nonsense like this? I guess their MTA has
> the "sender domain must resolve" checks turned off...

occasionally I've written one, to find:

    - it hits like 0.0001% of spam
    - my MTA tends to reject it before SpamAssassin gets involved ;)

it all depends if that got through to a user.  sounds like it didn't --
in which case, a SpamAssassin rule on top of whatever else caught
it, would be just wasting CPU time.

--j.