spam killing with poplib

[Robin Becker]

In article <S02bb.43098$NM1.7449 at newsread2.news.atl.earthlink.net>, Phil
Weldon <pweldon at mindspring.com> writes
>At best that will identify less than a third of the messages produced by
>this worm.  A permutating and mutating bogus 'Undeliverable e-mail' message
>carrying the infection package is more common than the HTML message.  Either
>type is over 100 KBytes, and will quickly clog a mailbox.
>
>Expect the HTML message body, FROM and SUBJECT  to mutate also.
>
>Phil Weldon, pweldon at mindspring.com
>
>"Simon Burton" <simonb at webone.com.au> wrote in message
>news:pan.2003.09.20.06.52.21.266409 at webone.com.au...
>>
>> This was so easy :)
>>
>> Simon Burton.
.... you're right, I had to use patterns like

re.compile('^subject:\s*((Microsoft|MS|Upgrade|Net|Network|New|Newest|
Latest|Last|Critical|Patch|Pack|internet|security|current|update)\s*)+$'
,re.IGNORECASE)
        
and check the from value as well. Even so I'm not getting all of them
and as you say mutation is happening.                   
-- 
Robin Becker