Virus Filter

I’ve written before about one of the various forms of Internet pestilence: messages bounced back from virus filters that claim you emailed them a virus, when in fact the mail header was forged and the virus originated elsewhere. It’s particularly frustrating to those of us who use GNU/Linux and thus are practically immune from viruses, at least those that propagate through email.

Here’s my latest attempt at an omnibus virus bounce procmail filter. Put this in ~/.procmailrc and most if not all of these messages should go away. Note that you need to increase from the default LINEBUF length to pack this all into one expreession:

LINEBUF=3000
:0

* ((^Subject: (Virus infection notice|New Network Security Upgrade|Newest Net Update|Newest Internet Upgrade|Newest Internet Security Patch|Internet Security Pack|New Internet Security Patch|Latest Critical Pack|Latest Net Upgrade|Latest Network Critical Update|(Latest|Current|Newest|New) (Microsoft|Net(work)?|Internet) (Security|Critical) (Update|Patch|Pack)|Current Microsoft Critical Pack|Newest Critical Pack|Latest Net Security Pack|Current Net Critical (Pack|Patch)|Latest Network Critical Pack|Abort Report|A virus has been detected in a document you authored.|RAV Antivirus:|BitDefender found an infected object|Virus Detected by Network Associates, Inc. Webshield|—— Virus Detected ——|Virus detected|Virus Alert|InterScan NT Alert|Virus found in the message|Message quarantined|VIRUS ALERT!|MDaemon Warning – Virus Found|Warning: E-mail viruses detected|ScanMail Message: To Sender virus found|VIRUS IN YOUR MAIL|Norton AntiVirus detected|VIRUS .* IN YOUR MAIL|Antigen found VIRUS|Filter incident|V.rus figyelmeztetés! Virus warning!|Symantec AVF detected|Returned due to virus;|Anti-Virus Notification|BANNED FILENAME|File blocked – ScanMail for Lotus|NAV detected a virus|RAV AntiVirus scan|VIRUS .+ IN MAIL FROM YOU|Virus Notification:|Virus found in a message you sent|Virus found in sent message|VIRUS EN SU CORREO|Warning: antivirus system report|M..Daemon Notification — Attachment Removed|Information – Antivirus|Symantec AntiVirus detected a violation|WARNING: YOU WERE SENT A VIRUS|SAV detected a violation in a document|MailMarshal has detected a suspect attachment|A virus was detected in your mail|Recipient Virus-alert|Virus Found in message|E-?mail viruses detected|Undelivered mail: VIRUS FOUND|Quarantined Mail: virus from|Failed to clean virus|Virusveszely! Virus warning!|Virus in mail from you.|Possible virus found in mess..age you sent|AntiVir ALERT|Centrale Anti-Virus melding|Vexira ALERT|You sent potentially unsafe content|ID.*thanks ScanMail has detected a virus!|\{Virus\?\}))|(^X-BLTSYMAVREINSERT|^X-Virus-Scan-Result: Repaired|^X-AtHome-MailScanner: Found to be infected|^X-Scanned: Symantec Antivirus Scan – Virus found|^X-Sender: NetMail AntiVirus Agent|^X-yoursite-MailScanner: Found to be infected|^X-ELTE-VirusStatus: was_infected)|(^To:.*MS Network Security))
virus

Suggestions for additional filter strings are welcome. This is an obvious case where there should be some standard for this kind of message, but of course each proprietary virus scanner company wants to have its own distinct announcement so as to advertise its product in the bounce message. The best thing would be something in the mail header other than the subject line.

I’ve also found the following recipe useful for filtering out a very common viral email that appears to be going around:

:0 BH
* ^Content-Type:.*(audio/x-wav|applica/x-msdownlo)
* > 100000
virus

You could probably substitute virus with /dev/null without any ill effects in both of these recipes.

Finally, a neat trick if you use SpamAssassin. This is covered in the documentation, but I only recently discovered it. Here’s a way to filter very certain spam into one folder, and pretty certain spam into another:

:0
* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*
verycertainspam

:0
* ^Subject:.*\*\*\*\*SPAM\*\*\*\*
probablyspam

Set the number of stars in the first recipe to be the SpamAssassin score you’d like to count as “very certain.”

Realtors is not generic

The U.S. Trademark Trial and Appeal Board announced on Tuesday that the term “realtor” is not generic, but instead a protectable mark. In other words, “realtor” isn’t just anyway who sells real estate, but attaches only to a member of the National Association of Realtors.

Mailman Troubles and WINE Successes

Steve· recently pointed out that the linux-disciples mail list archives· were two months out of date. Linux-disciples· is a small community maillist I administer for all-purpose newbie linux questions (technically it should be “GNU/Linux-disciples,” but that doesn’t roll off the tongue smoothly). Upon investigation, I discovered that Mailman· has not been archiving any of my mail lists since February.

Previously, I had the problem that ArchRunner (the mailman process that creates archives) was using up all my available CPU·. So I turned ArchRunner off and had it run (or so I thought) every night from midnight until 6am as a cron job under user ‘mailman’.

The problem, I just discovered, was that I had given the wrong path to ArchRunner in the mailman cron job. The error message was going to user ‘mailman’, which was, in fact, a list I had accidentally created.

So it turns out there were over 100,000 error messages that had been sent to the mailman list since February, and these messages were all waiting to be ‘archived’ by ArchRunner once it started running properly again.

The lesson to be learned? There can be an awful lot happening on your server without you realizing it, even running a few monitoring utilities such as logcheck· which are supposed to watch the log files. Also, make sure that error messages from a process that tries to run every minute don’t go to a nonexistent user, and particularly don’t go to a user who is actually a mailing list.

I’m also wondering why google isn’t indexing any of my mailing lists·. A major impetus behind linux-disciples· was to make these questions and answers appear in the search engines.

In other news, I’m using a tryout demo version of Codeweavers Crossover Office· to run Office XP under GNU/Linux. Normally, I do everything with OpenOffice, which I much prefer, but I’m doing some intensive document exchange with others at work, and as much as I’d like to believe it isn’t true, the conversion filter is not yet perfect. The documents we’re working on are legal documents that are ultimately filed as such with official entities. Unfortunately, I think I’ve got to compromise my free software values on this one… On the other hand, so far, CrossOver Office is holding up quite well, and I’ll probably buy a version if things continue to work well.

(no need to comment on why MS Office formats are very bad for legal/confidential documents—e.g., Word Macro Viruses·, accidental disclosure· of confidential information·, etc.·. I know.)

Firefox Reloaded

I’ve decided to support Mozilla FireFox’s promotional campaign, at least for a while, by adding this button to my sidebar:

Get Firefox

I wonder if they’ve worked out any possible trademark issues with The Matrix Reloaded. After all the trademark issues this project has had in the past, I would hope they would steer clear of future conflict. (Interestingly, Mozilla has filed with the USPTO for FIREFOX—smart move).

Linux Nightmare

This is a dream I just had: I was showing a movie on a large screen connected to my laptop running GNU/Linux. For some reason, the movie stopped playing. The file was gone. I noticed the drive was running continuously. I checked for free space:

 joehill:~>df -h Filesystem Size Used Avail Use% Mounted on /dev/hda2 55G 52G 133M 100% / 

and then again:

 joehill:~>df -h Filesystem Size Used Avail Use% Mounted on /dev/hda2 55G 51G 1.2G 98% / 

Somehow, files were disappearing. I checked for some process that might be deleting files:

 joehill:~>ps aux | grep rm joehill:~> 

or maybe an rsync job with the —delete switch?

 joehill:~>ps aux | grep rsync joehill:~> 

Nothing! I yanked out the network cable in an effort to stop the destruction. Still the free space continued to increase. Suddenly, the system reboots, but now the bootloader is gone, and I have a “no disk found” error.

Someone from my office comes over to help me, but can’t figure it out. He says, “I’ll call the trainer to help you get up to speed on Windows.”

Then I woke up in a cold sweat.

RIP Tooker Gomberg

More sad news: Tooker Gomberg·, a heroic environmental activist, has taken his own life·. I knew Tooker just a little: he stayed at my house in Vermont several years ago while travelling across the country by public transit and bicycle with his wife Angela. I’ve also received his frequent email missives over the years. The man had incredible energy, charisma, and a great sense of humor. One of his fellow city legislators described him thus:

He called him a man of conviction who walked or pedalled his bike or rode on public transit rather than drive a polluting vehicle. He wore clothes of natural fibres, he recycled, he composted and he gardened.
“I have never seen anyone who walked the talk like Tooker did,” he said. “He lived what he preached.”

Also see this tribute, “He was the Grain of Sand that Stopped the Machine”:

Tooker was bold, daring and defiant. He had spunk and chutzpah. He put his body on the line. Many times, he crossed that line. His mottoes were: From the ground up. Word to mouth. Small scale. Grassroots. Guerrilla gardening-style. He was the grain of sand that stopped the machine. Every day of his life was a renewed chance to change the world.

One tiny detail of his passing that seems particularly tragic to me: they found his bicycle and helmet on the bridge he jumped off. The image of Tooker putting on a helmet to bike to the spot where he would die is hard to accept.

Goodbye Spoon

I just discovered that spoon, aka Ian Truskett, has passed away.

I never met spoon, and had only exchanged a handful of emails with him. I maintain the Debian package of a perl module he wrote, libwww-shorten-perl (or WWW::Shorten). It’s an odd connection to have with someone, and now to realize that they died. I don’t know quite what to do about it.

It also reminds me that there are many small free software projects out there maintained by lone developers (I have several myself), and as the movement ages we need to figure out how to pass on the torch without too much disruption. Maybe we should all have something like a living will, expressing some sense of who should take up our projects when we’re gone.

I’m uploading spoon’s last release of WWW::Shorten into sid now, released just a few weeks before he died. It’s not much of a tribute, I know, but it’s the only thing I can think to do.

Spam Be Gone

I think I’ve found a solution to my persistent “spam referrer” woes, where porn sites (particularly “Paris Hilton” related—to whom, I continue to assert, I have no connection whatsoever) create spurious links from weblogs and boost their Google PageRank. About twice an hour, I have a script that looks up all the “recent inbound links” sites and checks to see if they actually link to my site. If they don’t, they’re removed.

I’m sure a few legitimate inbound links will be removed in the process, but it’s much preferable to having to manually cull out all the porn sites. As it turns out, porn sites never actually link to me!

I wonder how long it will take for the spam referrers to figure out a way around this filter.

Hurt

Johnny Cash’s music video Hurt may well be the saddest music video I’ve ever seen. I’d heard the song several times without realizing quite how sad it is.

A Moment of Silence for Spain?

I attended a lecture· yesterday as part of the Spirit of Fès·, an interfaith festival of sacred music that started in Fès, Morocco, and has spread throughout the world. The discussion concerned the possibility of bridging the divide between the great faith traditions to achieve peace in the world. One of the panelists made a startling observation: after last week’s bombing in Madrid, Spain·, there was no official national moment of silence or mourning of the tragedy in the United States.

On September 14, 2001, all of Europe observed a three-minute silence to remember the victims of the September 11 attacks·, as did most of the rest of the world. Yet, even though this was the worst terrorist attack in Spanish history, and Europe itself observed· a transnational moment of silence, there was no such response here.

Why is it that our tragedy is the world’s tragedy, but disaster elsewhere is reflected here primarily as fear of more terrorism on American soil?