Um...I would STRONGLY recommened someone think twice before using these rules. I see them hitting on LOTS of legit emails. Also only the last rule is a meta, so they will also score 1.00 on each hit, in addition to the meta rule. It is a great start, but I think they need more tweaking.
just my 2 cents! Chris Santerre System Admin and SA Custom Rules Emporium keeper http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm "A little nonsense now and then, is relished by the wisest men." - Willy Wonka > -----Original Message----- > From: Andreas Kotowicz [mailto:[EMAIL PROTECTED] > Sent: Saturday, September 20, 2003 11:01 AM > To: spamassassin talk > Subject: [SAtalk] microsoft worm - working solution > > > I found a posting in some newsgroup and modified the rules a bit. they > work for me very nice. here you go: > > header MDS_Swen_A_0 From =~ > /(email|inet|internet|mail|microsoft|ms|net|network)/i > header MDS_Swen_A_1 From =~ /(section|service|system)/i > header MDS_Swen_A_2 From =~ > /^\s*(admin|administrator)\s*$/i > header MDS_Swen_A_3 Subject =~ > /^\s*(advice|announcement|failure\s+report|letter|mail|notice| > report)\s*$/i > header MDS_Swen_A_4 Subject =~ > /^\s*(abort|bug|error)\s+\S+/i > header MDS_Swen_A_5 Subject =~ > /^.*\s+(advice|announcement|letter|message|notice)\s*$/i > header MDS_Swen_A_6 Subject =~ > /^\s*(mail:\s+|message|(returned|undeliverable|undelivered)\s+ > (mail|message))/i > header MDS_Swen_A_7 Subject =~ /^\s*$/ > header MDS_Swen_A_8 Subject =~ > /^(critical|current|internet|last|latest|microsoft|net|network > |new|newest|security)\s+/i > header MDS_Swen_A_9 Subject =~ > /^.*\s+(pack|patch|update|upgrade)/i > meta MDS_Swen_A ((( MDS_Swen_A_0 && > MDS_Swen_A_1 ) || > MDS_Swen_A_2 ) || ( MDS_Swen_A_3 || ( MDS_Swen_A_4 && > MDS_Swen_A_5 > ) || MDS_Swen_A_6 || MDS_Swen_A_7 ) || ( MDS_Swen_A_8 && > MDS_Swen_A_9 )) > describe MDS_Swen_A MDS - Swen A worm > score MDS_Swen_A +10.0 > > > > ------------------------------------------------------- > This sf.net email is sponsored by:ThinkGeek > Welcome to geek heaven. > http://thinkgeek.com/sf > _______________________________________________ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
