I found a posting in some newsgroup and modified the rules a bit. they work for me very nice. here you go:
header MDS_Swen_A_0 From =~ /(email|inet|internet|mail|microsoft|ms|net|network)/i header MDS_Swen_A_1 From =~ /(section|service|system)/i header MDS_Swen_A_2 From =~ /^\s*(admin|administrator)\s*$/i header MDS_Swen_A_3 Subject =~ /^\s*(advice|announcement|failure\s+report|letter|mail|notice|report)\s*$/i header MDS_Swen_A_4 Subject =~ /^\s*(abort|bug|error)\s+\S+/i header MDS_Swen_A_5 Subject =~ /^.*\s+(advice|announcement|letter|message|notice)\s*$/i header MDS_Swen_A_6 Subject =~ /^\s*(mail:\s+|message|(returned|undeliverable|undelivered)\s+(mail|message))/i header MDS_Swen_A_7 Subject =~ /^\s*$/ header MDS_Swen_A_8 Subject =~ /^(critical|current|internet|last|latest|microsoft|net|network|new|newest|security)\s+/i header MDS_Swen_A_9 Subject =~ /^.*\s+(pack|patch|update|upgrade)/i meta MDS_Swen_A ((( MDS_Swen_A_0 && MDS_Swen_A_1 ) || MDS_Swen_A_2 ) || ( MDS_Swen_A_3 || ( MDS_Swen_A_4 && MDS_Swen_A_5 ) || MDS_Swen_A_6 || MDS_Swen_A_7 ) || ( MDS_Swen_A_8 && MDS_Swen_A_9 )) describe MDS_Swen_A MDS - Swen A worm score MDS_Swen_A +10.0 ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
