well, that will match that string in the body..
but it should also match not having an attachment to return true.
On Tuesday, September 2, 2003, at 01:39 PM, Chris Santerre wrote:
-----Original Message----- From: Jonathan Vanasco [mailto:[EMAIL PROTECTED] Sent: Tuesday, September 02, 2003 1:10 PM To: [EMAIL PROTECTED] Subject: [SAtalk] Rule Help Needed
variant on sobig rules,
I'd like to have a rule for messages without attachments, if their body contains "See the attached file for details" The messages are multipart with one text/plain part
this would match sobig messages where the virus has failed to attach itself
um...
body MY_SOBIG /See the attached file for details/i
describe MY_SOBIG It is so big I don't know where to store it! I should get
lots of false positives here in the future.
score MY_SOBIG 10000.01
:-)
------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk