YM Tan wrote: > For example, I defined > [EMAIL PROTECTED] Virus-From: Junk Mail > > and tested that QS blocks From field as <[EMAIL PROTECTED]> > > But I found that when the spammer put the From address as > Tom & Jerry <[EMAIL PROTECTED]> > then the email can bypass the above rule. > "[EMAIL PROTECTED]" does not match "Tom & Jerry <[EMAIL PROTECTED]>" . You need something like "[EMAIL PROTECTED]" to match it.
The quarantine-attachments.txt format is for matching against a particular header *line* - so it must match the *line* - not just part of the line. i.e. you need a regex If you run "qmail-scanner-queue.pl -r" you would see all those entries are surrounded by "^" and "$" - to explicitly tell you that the entire line has to match the entry in order for it to trigger... -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 ------------------------------------------------------- This SF.Net email is sponsored by the JBoss Inc. Get Certified Today Register for a JBoss Training Course. Free Certification Exam for All Training Attendees Through End of 2005. For more info visit: http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click _______________________________________________ Qmail-scanner-general mailing list Qmail-scanner-general@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
