--On Sunday, September 21, 2003 10:31 PM -0400 Matt Kettler <[EMAIL PROTECTED]> wrote:
> However, you could write a custom rule or two to pick these off. > > A body rule something like this should do: > > body LOCAL_SVEN_WORM /\bThis is the latest version of security update\b/ > score LOCAL_SVEN_WORM 1.0 I've found a more consistent pattern: The From/To/Subject headers are all upper-case and always present, but don't always have any content. An example: > FROM: "Inet Email Delivery System" <[EMAIL PROTECTED]> > TO: "Email Receiver" <[EMAIL PROTECTED]> > SUBJECT: It also appears that systems that bounce these after finding the virus preserve these headers, so you'll catch some of the bounces with this, as well. ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
