RE: [SAtalk] Rule Help...

2003-12-23 Thread Lucas Albers
>> At 02:50 PM 12/12/2003, Dan Tappin wrote: >> >Here is a custom rule for a PayPal spoof virus that is going around. I >> >can't get this to trigger a hit in SA. I have linted my >> >rules and my config files are being loaded properly. Dan, Can you post your rule? I would like to see what you

RE: [SAtalk] Rule Help...

2003-12-12 Thread Matt Kettler
At 05:10 PM 12/12/2003, Dan Tappin wrote: Hi Matt, I created in a custom .cf file in /etc/mail/spamassassin Dan Hmm, then that should work correctly... --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or

RE: [SAtalk] Rule Help...

2003-12-12 Thread Dan Tappin
Hi Matt, I created in a custom .cf file in /etc/mail/spamassassin Dan > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Matt > Kettler > Sent: Friday, December 12, 2003 1:05 PM > To: [EMAIL PROTECTED]; [EMAIL PROTECTED] > Subje

Re: [SAtalk] Rule Help...

2003-12-12 Thread Matt Kettler
At 02:50 PM 12/12/2003, Dan Tappin wrote: Here is a custom rule for a PayPal spoof virus that is going around. I can't get this to trigger a hit in SA. I have linted my rules and my config files are being loaded properly. Which configfile did you add your rule to? local.cf or user_prefs? Do you

Re: [SAtalk] Rule Help...

2003-12-12 Thread Fred
Dan Tappin wrote: > Here is a custom rule for a PayPal spoof virus that is going around. I missed that one, try this out, they work for all previous scams I've seen. header __RCVD_PAYPAL Received =~ /paypal\.com/i header __FROM_PAYPAL From =~ /paypal\.com/i uri __URI_PAYPAL /paypal\.com/i head

[SAtalk] Rule Help...

2003-12-12 Thread Dan Tappin
Here is a custom rule for a PayPal spoof virus that is going around. I can't get this to trigger a hit in SA. I have linted my rules and my config files are being loaded properly. header PAYPAL_VIRUS_001 Subject =~ /YOUR PAYPAL\.COM ACCOUNT EXPIRES/i describe PAYPAL_VIRUS_001 Wonderfull PayPal

RE: [SAtalk] rule help please

2003-11-20 Thread Chris Thielen
Right, you can make an entire word optional by "grouping" it (enclosing it in parentheses) and marking the group as optional by tacking a question mark on the end. In your case (a single character) it is better to use one of the other examples where you mark either a character class that only matc

RE: [SAtalk] rule help please

2003-11-20 Thread ian douglas
> did you mean: > rawbody W98_UNSUBSCRIBE4 /prefer not to(?: )?see/i > Better yet: > rawbody W98_UNSUBSCRIBE4 /prefer not to[ ]?see/i > or even: > rawbody W98_UNSUBSCRIBE4 /prefer not to ?see/i Ah, didn't know I needed a trailing ? after the set of parentheses, I thought the syntax was only

Re: [SAtalk] rule help please

2003-11-20 Thread Fred I-IS.COM
Frederic Tarasevicius Internet Information Services, Inc. http://www.i-is.com/ 810-794-4400 mailto:[EMAIL PROTECTED] Hello, Try this: rawbody W98_UNSUBSCRIBE4 /prefer not to ?see/i ? means 0 or 1 of the previous So the previous space can appear 0 or 1 times ;) ian douglas wrote: > My rul

Re: [SAtalk] rule help please

2003-11-20 Thread Scott Lambert
On Thu, Nov 20, 2003 at 12:42:25PM -0800, ian douglas wrote: > My rule definition: > > rawbody W98_UNSUBSCRIBE4 /prefer not to(?: ) see/i > rawbody W98_UNSUBSCRIBE4 /prefer not to ?see/i -- Scott LambertKC5MLE Unix SysAdmin [EMAIL PROTECTED]

Re: [SAtalk] rule help please

2003-11-20 Thread guenther
> rawbody W98_UNSUBSCRIBE4 /prefer not to(?: ) see/i > > > I want this to catch "prefer not to see" and "prefer not tosee" but the > (?: ) doesn't seem to catch whether the space exists or not. rawbody W98_UNSUBSCRIBE4 /prefer not to ?see/i You simply want an optional space... ...guenther

[SAtalk] rule help please

2003-11-20 Thread ian douglas
My rule definition: rawbody W98_UNSUBSCRIBE4 /prefer not to(?: ) see/i I want this to catch "prefer not to see" and "prefer not tosee" but the (?: ) doesn't seem to catch whether the space exists or not. Spam message contains: If you'd prefer not tosee subsequent offers: I searched through

Re: [SAtalk] rule help please

2003-11-20 Thread Chris Thielen
Ian, did you mean: rawbody W98_UNSUBSCRIBE4 /prefer not to(?: )?see/i Better yet: rawbody W98_UNSUBSCRIBE4 /prefer not to[ ]?see/i or even: rawbody W98_UNSUBSCRIBE4 /prefer not to ?see/i -- Chris Thielen Easily generate SpamAssassin rules to catch obfuscated spam phrases: http://www.sandgn

Re: [SAtalk] Rule Help Needed

2003-09-02 Thread Jonathan Vanasco
:10 PM To: [EMAIL PROTECTED] Subject: [SAtalk] Rule Help Needed variant on sobig rules, I'd like to have a rule for messages without attachments, if their body contains "See the attached file for details" The messages are multipart with one text/plain part this would match sobig mes

RE: [SAtalk] Rule Help Needed

2003-09-02 Thread Chris Santerre
> -Original Message- > From: Jonathan Vanasco [mailto:[EMAIL PROTECTED] > Sent: Tuesday, September 02, 2003 1:10 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Rule Help Needed > > > > variant on sobig rules, > > I'd like to have a rule for mes

[SAtalk] Rule Help Needed

2003-09-02 Thread Jonathan Vanasco
variant on sobig rules, I'd like to have a rule for messages without attachments, if their body contains "See the attached file for details" The messages are multipart with one text/plain part this would match sobig messages where the virus has failed to attach itself ---

[SAtalk] Rule help?

2003-07-16 Thread Michael W. Cocke
I'm trying to work out a rule to bounce messages that contain no text - just a mime or base64 attachment. Using (and new to) SA 2.55. Any hints? Thanks! Mike- If you're not confused, you're not trying hard enough. Please note - Due to the i