Friendgreetings worm filter suggestion

["Dan Tappin" <dan.tappin@xxxxxxxxxxxxxxx>]

Dan

I am sure some one has received these 'greeting cards' e-mails and had
dumb-ass users click on the link and mass mail their Outlook address book.

I am trying to set-up a filter to stop this from happening again.

Here is the Symantec link:

http://securityresponse.symantec.com/avcenter/venc/data/friendgreetings.html

The body contains on of the following:

www.friend-card.com
www.friend-card.net
www.friend-cards.com
www.cool-downloads.com
www.cool-downloads.net
www.friend-greet.com
www.friend-greeting.com
www.friend-greeting.net
www.friend-greetings.com
www.friend-greetings.net
www.friend-cards.net
www.laugh-mail.com
www.hkg3.com
65.240.226.240

and the subject contains:

<<recipient>> you received a greeting e-mailed by <<sender>>.

I tried just adding:

 'you received a greeting e-mailed by' to the subject field

and:

*friendgreetings*|*friend-greet*|*cool-downloads*|*friend-card*|*laugh-mail*
|*hkg3* to the body

but test messages with this content are still going through.

I would also like to have this only apply to incoming mail / non-local mail.
I want to still be able to send warnings to the office and out to
third-party's etc.

Thanks,

Dan


---------
Tenon Intersystems' Post.Office Mailing 
List
To unsubscribe: send mail to 
post_office-request@xxxxxxxxx
with the subject: unsubscribe
Find the searchable mailing list archives 
at:
http://postoffice.computeroil.com/