Jump to content


  • Posts

  • Joined

  • Last visited

sdlawrence's Achievements


Newbie (1/6)



  1. Your link shows a red X. Could you edit the post? All I do is view the source of the message, and copy the first several characters of the embedded graphic. That becomes a filtering word (signature) - works like a charm! Is there any reason why the method I list above (e.g., just input that code/signature as text) wouldn't be as effective as generating a hex signature?
  2. Since implementing this filter, I have yet to see any of the ED-DRUGS or Buy Windows XP Professional, or Viagra, or any of the other spams that included those annoying little graphics. Each time a graphic embedded spam email came in, I viewed the source, captured a small part of its code, and added it to my filter. Now NONE OF THEM SHOW UP ANY MORE! SILENCE, SWEET SILENCE! Here is what my message rules filter for Thunderbird looks like: (located in C:\Documents and Settings\MyName\Application Data\Thunderbird\Profiles\woms0cl9.default\Mail\pop.mydomain.net\msgFilterRules.dat) version="8" logging="no" name="R0lGOD codes" enabled="yes" type="1" action="Delete" action="Delete from Pop3 server" condition="OR (body,contains,R0lGODlhTAEdAJ) OR (body,contains,R0lGODlhMQE9AJE) OR (body,contains,R0lGODlhX) OR (body,contains,R0lGODlhTAEd) OR (body,contains,R0lGODlhWw) OR (body,contains,R0lGODlhCg) OR (body,contains,R0lGODlhBQHH)" This only filters spam with the offending embedded graphics, nothing else. Deletes them from my system AND my pop3 server upon detection, and I never see them! If you just want to test it, change the rule so that it moves them to another folder - until you get comfortable with them - then you can just have the filter delete them. For those of you who don't use thunderbird, you can use the following list as words to filter on (i.e., If Message Contains....blah blah...) R0lGODlhTAEdAJ R0lGODlhMQE9AJE R0lGODlhX R0lGODlhTAEd R0lGODlhWw R0lGODlhCg R0lGODlhBQHH Believe it or not, I have yet to see any new ones. That small list above ZAPS all the embedded graphics spams I ever receive (and it used to be at least a dozen different ones from different addresses a day - now it's down to ZERO).
  3. OK, maybe I'm not so bright - it filters out ALL email that have any kind of .gif file embedded. Not so sure that's a good idea. Ideas anyone? OK - first off, it applies to all embedded graphics - .gif or .jpg. I went a little deeper into the code. The "ED-DRUGS" emails have a signature that looks like this: R0lGODlhX That was enough to catch only the "ED-DRUGS" embedded emails. The ones that look like this: http://www.examples.com/Mimubo.GIF I'm creating more specific filters for any others that make it through, as they come in. The fact that they repeat the use of the same tired graphics is handy. The stupid little pills graphic is commonly used by a lot of different spammers. Somewhere in the center of that code is a string of characters common to all of them. I'll find that and create a new filter using that string. Here's a screenshot of my SINGLE filter that I now use to accumulate offending graphics signatures: http://www.examples.com/filters.gif
  4. I stopped them completely. Here's the trick I used: View the message source (I use Mozilla Thunderbird, so I did it from there). The embedded graphics code begins (or at least it did in my case) EVERY TIME - with the characters: R0lGOD I created a filter, saying if the body of the message contains R0lGOD, delete the message, and then delete it from the server. It had the effect of not even downloading it from the server after that. I kept copies of the offending emails, and after putting the filter/rule into effect, I forwarded copies of the offending spam to myself. None of them made it past the filter. Several sent out to myself - none returned. It doesn't matter what graphic they use - there is a beginning code to it. Once filtered, they're gone. My only regret in posting this is that those bastards will eventually read this and find a workaround like the slimy, puss-infected, subhuman cockroach pieces of dung they are. Anyway, hope that helps.
  • Create New...