>> At 02:50 PM 12/12/2003, Dan Tappin wrote:
>> >Here is a custom rule for a PayPal spoof virus that is going around. I
>> >can't get this to trigger a hit in SA. I have linted my
>> >rules and my config files are being loaded properly.
Dan,
Can you post your rule?
I would like to see what you
At 05:10 PM 12/12/2003, Dan Tappin wrote:
Hi Matt,
I created in a custom .cf file in /etc/mail/spamassassin
Dan
Hmm, then that should work correctly...
---
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or
Hi Matt,
I created in a custom .cf file in /etc/mail/spamassassin
Dan
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Matt
> Kettler
> Sent: Friday, December 12, 2003 1:05 PM
> To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
> Subje
At 02:50 PM 12/12/2003, Dan Tappin wrote:
Here is a custom rule for a PayPal spoof virus that is going around. I
can't get this to trigger a hit in SA. I have linted my
rules and my config files are being loaded properly.
Which configfile did you add your rule to? local.cf or user_prefs?
Do you
Dan Tappin wrote:
> Here is a custom rule for a PayPal spoof virus that is going around.
I missed that one, try this out, they work for all previous scams I've seen.
header __RCVD_PAYPAL Received =~ /paypal\.com/i
header __FROM_PAYPAL From =~ /paypal\.com/i
uri __URI_PAYPAL /paypal\.com/i
head
Right, you can make an entire word optional by "grouping" it (enclosing it
in parentheses) and marking the group as optional by tacking a question
mark on the end. In your case (a single character) it is better to use
one of the other examples where you mark either a character class that
only matc
> did you mean:
> rawbody W98_UNSUBSCRIBE4 /prefer not to(?: )?see/i
> Better yet:
> rawbody W98_UNSUBSCRIBE4 /prefer not to[ ]?see/i
> or even:
> rawbody W98_UNSUBSCRIBE4 /prefer not to ?see/i
Ah, didn't know I needed a trailing ? after the set of parentheses, I
thought the syntax was only
Frederic Tarasevicius
Internet Information Services, Inc.
http://www.i-is.com/
810-794-4400
mailto:[EMAIL PROTECTED]
Hello,
Try this:
rawbody W98_UNSUBSCRIBE4 /prefer not to ?see/i
? means 0 or 1 of the previous
So the previous space can appear 0 or 1 times ;)
ian douglas wrote:
> My rul
On Thu, Nov 20, 2003 at 12:42:25PM -0800, ian douglas wrote:
> My rule definition:
>
> rawbody W98_UNSUBSCRIBE4 /prefer not to(?: ) see/i
>
rawbody W98_UNSUBSCRIBE4 /prefer not to ?see/i
--
Scott LambertKC5MLE Unix SysAdmin
[EMAIL PROTECTED]
> rawbody W98_UNSUBSCRIBE4 /prefer not to(?: ) see/i
>
>
> I want this to catch "prefer not to see" and "prefer not tosee" but the
> (?: ) doesn't seem to catch whether the space exists or not.
rawbody W98_UNSUBSCRIBE4 /prefer not to ?see/i
You simply want an optional space...
...guenther
Ian,
did you mean:
rawbody W98_UNSUBSCRIBE4 /prefer not to(?: )?see/i
Better yet:
rawbody W98_UNSUBSCRIBE4 /prefer not to[ ]?see/i
or even:
rawbody W98_UNSUBSCRIBE4 /prefer not to ?see/i
--
Chris Thielen
Easily generate SpamAssassin rules to catch obfuscated spam phrases:
http://www.sandgn
well, that will match that string in the body..
but it should also match not having an attachment to return true.
On Tuesday, September 2, 2003, at 01:39 PM, Chris Santerre wrote:
-Original Message-
From: Jonathan Vanasco [mailto:[EMAIL PROTECTED]
Sent: Tuesday, September 02, 2003 1:1
> -Original Message-
> From: Jonathan Vanasco [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, September 02, 2003 1:10 PM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] Rule Help Needed
>
>
>
> variant on sobig rules,
>
> I'd like to have a rule for messages without attachments, if
> their bo
13 matches
Mail list logo
