Create a Mail rule to block the w32.sobig.f spam worm
Aug 20, '03 09:31:00AM
Contributed by: robg
Andrew Stone of Stone Design sent in a submission for dealing with the w32.sobig.f worm that's currently filling many OS X users' mailboxes with hundreds of junk emails. I had also received a couple emails from users about the flood of email, and had started working on the same thing last night. Since it appears to be hitting a large number of people, here's Andrew's Mail rule which will automatically delete the vast majority of these worm spams. You can read more about the worm on Symantec's site.
Create a new Mail rule, and set "If 'any' of the following conditions are met," and add all of these conditions:
- Subect - Ends with - My details
- Subect - Ends with - Your details
- Subect - Ends with - Your application
- Subect - Ends with - Wicked screensaver
- Subect - Ends with - That movie
- Subect - Ends with - Approved
- Subect - Ends with - Details
- Subect - Ends with - Thank you!
- From - Is equal to - admin@internet.com
In the "Perform the following actions" section of the dialog, set the first action to "Delete message" and the second to "Stop evaluating rules." Make this new rule the first rule in your rules list, so it runs before everything else. Andrew created an image that displays the finished rule.
The macosxhints mail server has some spam-killing software installed, and it's done a good job at sheltering my inbox from the onslaught, but I still received over 50 of these in the last 24 hours. I've now added the above rule to my Mail rule definitions, though I choose to transfer them to a "Probably Junk" mailbox as opposed to deleting them. That way, I can review them just to be sure none are "real" emails (in particular, the "Thank you!" condition will probably catch a couple real emails).
Side note: Yes, just two hints today ... sorry, but that's the way it goes sometimes!
Comments (28)
Mac OS X Hints
http://hints.macworld.com/article.php?story=20030820063155258