On Monday, August 25, 2003 4:29 PM, Chris Trudeau-Personal wrote: > My rule didn't fire, but has in the past...not sure what I'm donig > wrong...but here is the rule:
> rawbody MY_IMAGE_FILE /filename="[^"]*\.(gif|jpg)"/ > what am I missing in my expession...anyone? Bueller? Try: body URI_CID_PIC /\bcid\:\S+\.(?:jpg|gif)\b/ Since this specific spammer is *always* using cid:pic.gif, you could probably make it more specific. Works for me. -- Jay Swackhamer <[EMAIL PROTECTED]> Nebularis Inc <http://www.nebularis.com> Tel: 1-613-843-9358 Fax: 1-613-825-5960 ------------------------------------------------------- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
