On Fri, 19 Sep 2003, Steven W. Orr wrote: > But I don't want to block with a procmail rule. I want to block it with an > SA rule. In fact, I don't even use procmail. I use spamass-milter. I want > all my spam to be rejected before it gets in.
I realize this isn't what you asked for, but this is the procmail rule I came up with -- perhaps someone can port it to a SA rule. The body is constructed from some changeing elements and some fixed one. This rule looks for a fixed table line, the next line has variable text but always ends in <BR><BR>, and the third line is fixed. I have it set to look for <170000 so it also catches sanitized messages, I'm sure the size could be tweaked. (That is the problem with using SA for catching virueses -- if the virus gets bigger than 250k it won't even be looking at it) :0 B * <170000 * ^<TABLE WIDTH=(3D)?"600"><TR><TD><FONT SIZE=(3D)?"2">$[a-z ]+<BR><BR>$this is the latest version of security update, the /var/adm/Vbs ========================================================== Chris Candreva -- [EMAIL PROTECTED] -- (914) 967-7816 WestNet Internet Services of Westchester http://www.westnet.com/ ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
