From: Gavin Sinclair <gsinclair@...>
Date: 2003-09-20T22:15:40+09:00
Subject: Re: POP3Filter for SoBig.F Virus:

On Saturday, September 20, 2003, 9:03:18 PM, Shashank wrote:


> "Austin Ziegler" <austin@halostatue.ca> wrote in message
>> On Sat, 20 Sep 2003 10:14:39 +0900, Austin Ziegler wrote:
>> > http://www.rubygarden.org/ruby?SoBigPopper
>>
>> Gavin made a nice improvement that I have incorporated on the main page; I
>> have also fixed a couple of bugs with the detection code. Thanks, Gavin.

> Thank you very Austin and Gavin.

> I have been inundated with spam in the last few hours and this nice little
> utility has helped me a lot.

> I have a question though: the size of email defaults to 120_000. Is there
> some significance to this number or is it just an arbitrary number you
> picked. I have been getting some spam with attachments which are 106K or in
> that range. Of course, I have changed my version to catch them too but was
> curious to find out.

All of my virus-spam messages have been around 140Kb.  One exception
was about 15Kb.

> Also, would it possible for you to add something like the "kill file"
> support so that I can keep adding new patterns to it instead of modifying
> the source code.

No need really, and I don't have the time.  But you can go for it and
change the Wiki code if you like.  Or if your version is significantly
different then offer it as a separate implementation.

The easiest and quickest thing to do would be to add filters to the
source code on the Wiki.  If you need different filters, then someone
else probably will too.

I think a lot of people have learned about Net::POP3 today, especially
me.

Gavin