New pseudo meds spams spreading around !!!

[Bernard Lheureux <be...@lheureux.be>]

I already received 6 of this kind within the last 4 hours. (quoted)...

 > Vous recevez le! Service de grande importance chez nous. Si vous sans 
crainte tout ce dont vous avez besoin de medicaments!

 > http://groups.yahoo.com/group/vypimonuqugah19/message/1 
<http://groups.yahoo.com/group/vypimonuqugah19/message/1%20>

Already found rules to avoid those kind of bullshits ?
Thanks for your help...

 M$-Internet Exploder est le cancer de l'Internet, voyez pourquoi ici :
 http://www.aful.org/publi/articles/msie_et_la_securite/index_html/view

--
(°-   Bernard Lheureux Gestionnaire des MailingLists ML, TechML, LinuxML
//\   http://www.bbsoft4.org/Mailinglists.htm ** MailTo:root@bbsoft4.org
v_/_  http://www.bbsoft4.org/ <<<<<< * >>>>>> http://www.portalinux.org/

Re: New pseudo meds spams spreading around !!!

[Charles Gregory <cg...@hwcn.org>]

On Sat, 18 Jul 2009, Charles Gregory wrote:
> uri /http:\/\/groups.yahoo.com\/group\/[^\/]{10,20}\/message\/1$/

Oops. Don't forget to throw a RULE NAME into that rule. Sorry.
I keep omitting stuff like that because I edit/save my rules in a handy 
little 'shorthand' format file, with everything on one line, like this:

{DateSeq} {rule-type} /{rule}/ {"description"{ {score}

I then run a script on my pseudo-rules, to process them
into standard SA three-line rule definitions, in a .cf file.
It makes for a shorter/cleaner file for me to edit, and also allows
me to run a simple script against the logs and then process
it on the shorthand file to remove rules that no longer trigger...

I also have the script handle a few other minor code-tweaks, like
automatically inserting "?:" into groupings and escaping any use of "@".

The rule, between slashes, is the same, but the format leads to
some weird quoting when I post a rule. :)

- Charles

Re: New pseudo meds spams spreading around !!!

[Charles Gregory <cg...@hwcn.org>]

On Sat, 18 Jul 2009, Bernard Lheureux wrote:
> I already received 6 of this kind within the last 4 hours. (quoted)...
>>  http://groups.yahoo.com/group/vypimonuqugah19/message/1 
> Already found rules to avoid those kind of bullshits ?
> Thanks for your help...

Isn't it obvious?

uri /http:\/\/groups.yahoo.com\/group\/[^\/]{10,20}\/message\/1$/

Score high if it seems unlikely that any of your users will receive
a legitimate message referencing the FIRST posting in a yahoo group.

- C