[Wolves] Exim - blocking by subject

[Wayne]

Andy Smith wrote:
> Hi,
>
> On Mon, Jul 23, 2007 at 10:58:17AM +0100, Wayne wrote:
>   
>> Can some tell me the correct format for deny by subject in exim - can't 
>> find it on google due to the millions
>> of hits generated by 'subject'
>>     
>
> http://lists.exim.org/lurker/message/20040322.223500.9f668e60.html
>
> But I would try hard to find a way to do this before DATA phase,
> i.e. based on IP, envelope sender, HELO string, etc etc.
>
> Cheers,
> Andy
>   
> rg.uk/mailman/listinfo/wolves

Nice one.
I've been getting a mass of 'You have received a postcard/greeting 
card/ecard from a mate/family/colleague' all pointing to
exe files. These must be on compromised home pc's because the only thing 
in common is the subject, the from and html all pointing to
different addresses - making a common filter on ip etc impossible.