[Mimedefang] Discard by $Subject

[G. Roderick Singleton]

On Thu, 2005-11-24 at 09:52 +0200, ms at interspace.net wrote:
> Hello List,
> 
> I have this iritating email keep getting through no matter how many times i put
> it through the sa-learn!!!
> 
> My config is:
> Debian Sarge 3.1a with Sendmail 8.13 + mimedefang 2.51 (i know i should
> upgrade..but still) + sa 3.0.3 + clamd 0.87
> 
> So know i want to build a mimedefang rule to block this SPAM by its Subject,
> which never changes.
> Can any one offer a code?? (my perlish is a bit lame...;-) )
> B.T.W. : you may have seen/recieved that spam...subject is:
> The Ultimate Online Pharmaceutical
> 

Do it in sendmail.mc. e.g. something like:

dnl # regex map for common virus subjects
dnl # first, define some handy macros
define(`V1', `correction|immunity|pack|patch|powful|removal|security|
tool|update')dnl
dnl define(`V2', `klez|M\$$|Microsoft|WinXP')dnl
dnl # use macros in various permutations (see resulting sendmail.cf)
define(`Rxvirus1', `(V1).+(V1)|(V1).+(V2)|(V2).+(V1)')dnl

KVirus1 regex -a at MATCH Rxvirus1

LOCAL_RULESETS
HSubject: $>+CheckSubject
D{VMsg}This message may contain a virus.

SCheckSubject
R$*         $: $(Virus1 $&{currHeader} $)
R at MATCH     $#error $: 550 5.7.0 ${VMsg}

Well I am certain you get the idea. Adapt to your needs.

-- 
G. Roderick Singleton <gerry at pathtech.org>
PATH tech