RevChangeslink
3.2.2 Fix bug in chain validator when by host is invalid.download
3.2.1 Fix bug in Received chain validator.download
3.2 Process all non bounces as spam. 
3.1.5 Remove [in.file].done before attempt to rename and fail if rename fails. 
3.1.4 Add check for spam traps in x-envelope-to: (virtual BCC) line. 
3.1.3 Add check for spam traps in CC: line.download
3.1.2 Changed to only set bounceDom from line with myISP in Received: line. 
3.1.1 Change Exception handling so if DB is down it errors straight out. Or if whois status contains "Unable to connect to" it now creates .redo file to mark to be processed later.download
3.1 Read all header lines into a HashMap of Vectors and process after so order is not longer an issue. Also move header parsing code to SpamInfo class. 
3.0.4 Change mail box parser to save files .em instead of .eml so virus software will not remove the files when you try view them. 
3.0.3 Fix a couple problems parsing odd Received lines and add some date support for more date formats. 
3.0.2 Only clear buffer on first instance of inSpam indication. (Ignore Return-Path: inside bounced spam attachment). 
3.0.1 Add email parm for source hostname. 
3.0 Rewrite Received: line parsing to validate all entries against each other and against the by from the previous line to weed out forgeries. 
2.2.4 Throw Exception if source is reported to be my.domain or my.IP. 
2.2.3 Ignore hostname/IP following HELO if preceeded by unknown. 
2.2.2 Mark those with (HELO my.domain) as virus email. 
2.2.1 Fix prob with box parser where it would sometimes see a From in a message and take it as the start of the next one. 
2.2 Add code to decode HTML where characters have been converted to numbers to hide link from the parser. Also changed code insert the orginal spam (with minor clean up) as text (see 2.1) and the decoded version as the attachment. 
2.1.1 Change parseRecLine() to set host name to IP if no host name found. 
2.1 Add spam as text to bottom of text part of report via ATTACHMENT parm. See examples. 
2.0 Add class for detecting viruses. 
1.2.4 Fix bug in From parsing. 
1.2.3 Add code to verify source hostname matches source IP. If not use the IP insteaddownload
1.2.2 Set batch during parseBox() and then set from parent dir instead of setting to current time at start of run so partial runs still have the correct batch label for emails. 
1.2.1 Fix a couple of problems with the parser 
1.2 Add code to report virus emails  
1.1.1 Change code to log exception from send err and not create report if send had error. Also added GenStatsdownload
1.1 First public version.
Convert to use HSQL DB
 
1.0 add code to send directly to abusers instead of SpamCop 
0.6 filter spam with Content-Type: application/ as possible virus emails 
0.5 add save of decoded version if has decoded Javascript  
0.4 add timestamp to output paths 

Required 3rd party tools:
HSQLDBhere hsqldb_1_7_1.zip
Rhinohere rhino15R41.zip
Java 1.4.2here
Java Mailhere
JavaBeans Activation Frameworkhere


Installation:
I’ve tried to make everything pretty much self explanatory.
1.) You will need to install the above tools per their instructions.
2.) Unzip the spamRescue zipfile. (configs assume /spam)
3.) Edit SpamRescue.bat to match where paths to where you installed these tools.
4.) Edit spamRescue.properties to reflect you domain, email addresses and where you want the working directories to be. Also there are a few options such as whois support. Every option has a comment with it.
5.) Edit spam.txt and bounce.txt. Note all %%WORD%%s will be swapped out by the program with live data.
6.) Download mail box (squirrelmail is what was tested with but I think others should be close enough to work) with spam and bounces in it to file path set in spamRescue.properties.
7.) Run SpamRescue.bat –h to see options for running SpamRescue.

I suggest running it with –ns (no send) till you get the feel of it.

If you find a problem you can let me know at bugs@spamRescue.net but as I’ve said before I wrote this for my use and I don’t have the bandwidth to make it generic. But I’m figuring it will work for many of you. If you come up with a new whois class send it along and I’ll post it here too. (Note source for my child class is included in the zip.)

I have left out most of the source since the reason for me writing this in the first place is to handle all the script kiddies out there running this spam generator and I sure don’t want to teach them how to be more effective.

Dave

This page has been viewed 2001 times since 4/12/2004