pop3 email header classifier?

[Alex Martelli]

<posted & mailed>

Robin Becker wrote:

> Hi, I'm getting vast numbers of fake upgrade emails containing some kind
> of virus. My rather old client can be made to reject these based on some
> patterns in the subject line. They're nearly all based on the word
> 'New', 'Latest', 'Microsoft', 'Patch', 'Pack', ... etc etc.
> 
> Is there a python tool that can be made to delete these from my POP3
> mail box rather than let my client reject? Quite a few seem to have
> semi-valid return addresses so I get postmaster rejects from
> xxx at microsoft.com etc.
> 
> I know about spam-bayes etc, but these things are over 120k each and it
> seems pretty pointless to download them (as well as taking about an
> hour).

I posted an "emergency script" to be used for the purpose -- it
triggers SOLELY on mail size.  I have now enhanced it with lots of
options etc, but the basic idea remains that of size-only triggering --
risky but, it IS an emergency.  BTW, the "postmaster rejects" are
likely not connected to what you do with the "fake upgrade emails",
alas -- rather, virus senders are now faking "From:" &c addresses,
so everybody's getting lots of bounce msgs for mails they never sent.


Alex