pop3 email header classifier?

[Tim Roberts]

Robin Becker <robin at jessikat.fsnet.co.uk> wrote:
>
>Hi, I'm getting vast numbers of fake upgrade emails containing some kind
>of virus. My rather old client can be made to reject these based on some
>patterns in the subject line. They're nearly all based on the word
>'New', 'Latest', 'Microsoft', 'Patch', 'Pack', ... etc etc.
>
>Is there a python tool that can be made to delete these from my POP3
>mail box rather than let my client reject? Quite a few seem to have
>semi-valid return addresses so I get postmaster rejects from
>xxx at microsoft.com etc.

Is your e-mail client actually set up to send a RESPONSE when you receive a
virus attachment?  If so, can you please STOP IT AT ONCE?

ALL viruses released in the last 3 years choose random names for both the
sender AND recipient.  It is not possible to automatically extract the
infected individual's e-mail address from a virus message.  You can find
the address of their e-mail server, but that's all.

By sending a polite "you sent me a virus" message, you are doing NOTHING to
stop the viruses, you are ANNOYING an innocent person, and you are DOUBLING
the e-mail volume damage caused by the virus script kiddies.

I got close to 10,000 helpful and completely bogus "you sent my a virus"
messages during the "SoBig" fiasco.
-- 
- Tim Roberts, timr at probo.com
  Providenza & Boekelheide, Inc.