Hi!
I have been trying to add a signature to detect an hoax and I can't seem to get it
right...
What I have been trying to use to detect that hoax is the email address they refer to
which is always [EMAIL PROTECTED] (regarless of the language the message is
written in).
If I write don't use the "regexp-like" (|) operator to make sure the signature is
case-insensitive I can detect it but as soon as use them it no longer works...
[eg something like (61|41)(6e|4e)(6e|4e)(61|41) for the "anna" part...]
What am I doing wrong?
Thanks in advance!
Nick
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
