Not sure if this helps but by lowering threshold (required_hits) to 4 rather than 5, increasing FRIEND_AT_PUBLIC score FRIEND_AT_PUBLIC 3.0 and adding filter for various attachments I don't commonly get via procmailrc:
:0 B: * ^Content-Type:.*(application|audio|multipart) * name=.*\.(pif|mp3|src|exe) /dev/null I'm getting few if any of that microsoft crap. It's ugly but if they send us enough, I'm hoping I can train the bayesian filters on this better. The fact that there are several iterations out there, some basically empty and almost looking inocuous, it looks like the monkeys are just jiggling the doorknobs looking for which door is open... =-=-=-=-=-=-=-=-=-=-=-=- generated by /dev/dave -=-=-=-=-=-=-=-=-=-=-=-=-=-= David Stern University of Maryland Institute for Advanced Computer Studies ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk