John McGivern wrote:
Hi everyone,
I don't know if you guys get the SPAM that advertises the "Banned CD" I get dozens of them. Anyway, I've added a body rule looking for the term "bannedc" or "banned c" and yet it still doesn't catch it eventhough the text is right there! I know the rule is working because if I email myself something with this phrase, it gets blocked. So, how do they put actual text in an email and it by SA? The source for the email is below.
Thanks!
John,
What is the actual rule you are using in SA? Are you forgetting the "i" switch?
body BANNED_CD /banned c/
will not match "Banned CD", but
body BANNED_CD /banned c/i
will match it.
Even better might be: /banned\s*c\s*d/i
--Rich
_________________________________________________________
Rich Puhek ETN Systems Inc. 2125 1st Ave East Hibbing MN 55746
tel: 218.262.1130 email: [EMAIL PROTECTED] _________________________________________________________
------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
