« Sobig Virus | Main | Free Stuff on the Radio »

Message Rules Are Your Friend

I've seen two sites I frequent complain about the Sobig virus in the past couple of days. One of them simply slogged through the junk deleting each individual message. The other adjusted his SpamAssassin threshold to be lower and ended up blocking legitimate email.

It frustrates me that people complain sometimes without examining all of their options to see if there is anything they can do to fix it on their end. The home user doesn't usually have control over their mail server, so my previous rant on Sobig doesn't apply to them. But the most popular email clients I know of are Eudora and Microsoft's Outlook and Outlook Express. All of these mail clients support message rules. Since successful propagation of an email virus isn't an everyday occurrence, using message rules to control them is a feasible solution. An email virus is usually pretty small and has a finite quantity of message subjects and bodies that it can use. You can go to any anti-virus web site and find out what these are once the virus has been examined by the popular anti-virus people (Symantec, McAfee, and TrendMicro).

Once you know what they are, you open up your message rules (or filters as my email client calls them) and setup a filter that moves all messages with a specific subject (the subjects the virus is known to use) to a special folder. Voila. When your mail client gets mail, it runs these message rules on each one. As soon as one is triggered, it executes the action you told it to. In this case, it will find a message with a subject that is a known virus message subject (usually something generic like "Re: Your document") and moves it to a quarantine folder you have setup. You can then quickly scan this folder to see if anything that looks legitimate ended up in there (not likely). You can even have the message deleted right away if you're confident no one will send you email with one of these subjects.

Frankly, if someone sends me an email titled "Re: Check out this cool screensaver", it can go to the trash even if it's not a virus.

Post a comment

(If you haven't left a comment here before, you may need to be approved by the site owner before your comment will appear. Until then, it won't appear on the entry. Thanks for waiting.)

About

This page contains a single entry from the blog posted on August 22, 2003 10:47 AM.

The previous post in this blog was Sobig Virus.

The next post in this blog is Free Stuff on the Radio.

Many more can be found on the main index page or by looking through the archives.

Powered by
Movable Type 3.34