well, that will match that string in the body..


but it should also match not having an attachment to return true.

On Tuesday, September 2, 2003, at 01:39 PM, Chris Santerre wrote:



-----Original Message-----
From: Jonathan Vanasco [mailto:[EMAIL PROTECTED]
Sent: Tuesday, September 02, 2003 1:10 PM
To: [EMAIL PROTECTED]
Subject: [SAtalk] Rule Help Needed



variant on sobig rules,

I'd like to have a rule for messages without attachments, if
their body
contains "See the attached file for details"
The messages are multipart with one text/plain part

this would match sobig messages where the virus has failed to attach
itself


um...


body MY_SOBIG /See the attached file for details/i
describe MY_SOBIG It is so big I don't know where to store it! I should get
lots of false positives here in the future.
score MY_SOBIG 10000.01


:-)



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk




------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Reply via email to