Hi Kenneth, > -----Original Message----- > From: Kenneth Porter
> --On Sunday, September 21, 2003 10:31 PM -0400 Matt Kettler > <[EMAIL PROTECTED]> wrote: > > > However, you could write a custom rule or two to pick these off. > > > > A body rule something like this should do: > > > > body LOCAL_SVEN_WORM /\bThis is the latest version of > security update\b/ > > score LOCAL_SVEN_WORM 1.0 > > I've found a more consistent pattern: The From/To/Subject > headers are all upper-case and always present, but don't always > have any content. An example: > > > FROM: "Inet Email Delivery System" <[EMAIL PROTECTED]> > > TO: "Email Receiver" <[EMAIL PROTECTED]> > > SUBJECT: This is interesting. In 99% of my messages, the subject is capitalized but the From/To are not. > It also appears that systems that bounce these after finding the > viruspreserve these headers, so you'll catch some of the bounces > with this, as well. --Larry ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
