At 12:47 15/08/03 -0700, Abigail Marshall wrote:
GD> I'm trying to block all the annoying SoBig viruses - so I have the
GD> following:
GD> body SO_BIG_VIRUS /Please see the attached zip file for details\./
GD> score SO_BIG_VIRUS 6.0
GD> header SO_BIG_ATTACHMENT ALL =~ /your_details\.zip/
GD> score
> -Original Message-
> From: Geoff Dyment [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, July 09, 2003 12:27 PM
> To: 'Spam Talk'
> Subject: RE: [SAtalk] Attachment Checks
>
> Well followed the tutorial for doing a sitewide MTA using postfix,
> Amavisd,
>
> The title is actually in the body, not the header. (Possibly
> you need the "rawbody" directive. I'm not sure) For SA, your
> first recipe is enough to score any email for Sobig.E.
Oh, that was just for testing - I'm pretty sure I tried BODY and RAWBODY -
neither were caught, but I'll try again
GD> I'm trying to block all the annoying SoBig viruses - so I have the
GD> following:
GD> body SO_BIG_VIRUS /Please see the attached zip file for details\./
GD> score SO_BIG_VIRUS 6.0
GD> header SO_BIG_ATTACHMENT ALL =~ /your_details\.zip/
GD> score SO_BIG_ATTACHMENT 3.0
The title is actually in
