Not sure if this helps but by lowering threshold (required_hits) to 4 rather
than 5, increasing FRIEND_AT_PUBLIC score FRIEND_AT_PUBLIC 3.0 and adding
filter for various attachments I don't commonly get via procmailrc:
:0 B:
* ^Content-Type:.*(application|audio|multipart)
* name=.*\.(pif|mp3|sr
[EMAIL PROTECTED]
> Sent: Saturday, September 20, 2003 11:01 AM
> To: spamassassin talk
> Subject: [SAtalk] microsoft worm - working solution
>
>
> I found a posting in some newsgroup and modified the rules a bit. they
> work for me very nice. here you go:
>
> header
I found a posting in some newsgroup and modified the rules a bit. they
work for me very nice. here you go:
header MDS_Swen_A_0From=~
/(email|inet|internet|mail|microsoft|ms|net|network)/i
header MDS_Swen_A_1From=~ /(section|service|system)/i
header MDS_Sw
That filters a lot more than just the worm.
The MDS_Swen_A will be true with only one of MDS_Swen_A_3,
MDS_Swen_A_6 or MDS_Swen_A_7 is true.
Now each of those ALONE already filter millions of legal mail
away that you might want to receive.
--
Carlo Wood <[EMAIL PROTECTED]>
---
I found a posting in some newsgroup and modified the rules a bit. they
work for me very nice. here you go:
header MDS_Swen_A_0From=~
/(email|inet|internet|mail|microsoft|ms|net|network)/i
header MDS_Swen_A_1From=~ /(section|service|system)/i
header MDS_Sw
