[Security-Discuss] Postfix filter for Sober.Q AKA german spam emails

I got pretty annoyed with the new Sober variant (Q) sending german spam emails to our 
system all day so I've written a postfix filter. Simply put "header_checks = 
regexp:/etc/postfix/header_checks" inside /etc/postfix/main.cf (without the qoutes, on 
a line by itself) and place the following inside /etc/postfix/header_checks 
 
/^Subject: .*Armenian Genocide Plagues Ankara 90 Years On.*/    DISCARD SoberQ SPAM 
/^Subject: .*Auf Streife durch den Berliner Wedding.*/    DISCARD SoberQ SPAM 
/^Subject: .*Deutsche werden kuenftig beim Arzt abgezockt.*/    DISCARD SoberQ SPAM 
/^Subject: .*Du wirst zum Sklaven gemacht.*/    DISCARD SoberQ SPAM 
/^Subject: .*Paranoider Deutschenmoerder kommt in Psychiatrie.*/    DISCARD SoberQ 
SPAM 
/^Subject: .*S.O.S. Kiez! Polizei schlaegt Alarm.*/    DISCARD SoberQ SPAM 
/^Subject: .*The Whore Lived Like a German.*/    DISCARD SoberQ SPAM 
/^Subject: .*Transparenz ist das Mindeste.*/    DISCARD SoberQ SPAM 
/^Subject: .*Turkish Tabloid Enrages Germany with Nazi Compariso.*/    DISCARD SoberQ 
SPAM 
/^Subject: .*Verbrechen der deutschen Frau.*/    DISCARD SoberQ SPAM 
/^Subject: .*Volk wird nur zum zahlen gebraucht.*/    DISCARD SoberQ SPAM 
/^Subject: .*Vorbildliche Aktion.*/    DISCARD SoberQ SPAM 
/^Subject: .*Trotz Stellenabbau.*/    DISCARD SoberQ SPAM 
 
 
Then restart postfix (service postfix restart) 
 
Please note this is NOT a complete list! if you find anymore subjects that the worm 
uses I would appreciate it if you sent them to me. 
 
Cheers, 
Jordan.

____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________