Steve, Something like this: header _VBOUNCE_h_sobigf Subject =~ /(?:Re\: Details|Re\: Approved|Re\: Re\: My details|Re\: Thank you\!|Re\: That movie|Re\: Wicked screensaver|Re\: Your application|Thank you\!|Your details)/ body _VBOUNCE_b_sobigf /(?:See the attached file for details|Please see the attached file for details\.)/ meta VBOUNCE_m_sobigf (_VBOUNCE_h_sobigf &&_VBOUNCE_b_sobigf) describe VBOUNCE_m_sobigf Sobig.f virus score VBOUNCE_m_sobigf 0.1
Sorry if that wraps ugly, but check out many, many, more at http://www.exit0.us/index.php/VirusBounceRules Also, if your MTA can handle body checks, this worked pretty well for rejects /^RSLxwtYBDB6FCv8ybBcS0zp9VU5of3K4BXuwyehTM0RI9IrSjVuwP94xfn0wgOjouKWzGXHVk3 qg$/ REJECT SoBig.F related file Last but not least.... SoBig.F expired yesterday and has been shutting itself down. Only systems with bad time should still be sending out copies. HTH, Matt -----Original Message----- From: Steven W. Orr [mailto:[EMAIL PROTECTED] Sent: Friday, September 12, 2003 4:09 PM To: Larry Rosenman Cc: spamassassin talk Subject: Re: [SAtalk] Has anyone written rules for Sobig:F On Friday, Sep 12th 2003 at 15:49 -0500, quoth Larry Rosenman: =>--On Friday, September 12, 2003 09:11:10 -0400 "Steven W. Orr" =><[EMAIL PROTECTED]> wrote: => =>> that I can just add? =>> =>> TIA => =>add a virus scanner. => =>LER Ok. Let be be more clearerer. What I'm looking for is a set of recipes for rejecting the Sobig:F virus based on the text that appears in the Subject line. i.e., your account, Thank you, Wicked screensaver, That movie, My details, Approved, Your details, etc... In addition, it would be interesting if someone also had a check in there for the X-MailScanner header which also accompanies it. -- -Time flies like the wind. Fruit flies like a banana. Stranger things have - -happened but none stranger than this. Does your driver's license say Organ -Donor?Black holes are where God divided by zero. Listen to me! We are all- -individuals! What if this weren't a hypothetical question? steveo at syslang.net ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
