On Tuesday 23 September 2003 13:21 CET Garret Brady wrote: > I'm using spamassassin 2.55 direct from procmail on a PII450 > running .rh8.0. I notice that mails with dos executables > get through, even though I've the line > > score MICROSOFT_EXECUTABLE 5.0 > > in my ~/.spamassassin/user_prefs file. Other rules in the > file work fine.
Jepp, the rule is slightly broken, especially for those "use this patch now" worms. It currently uses this RegExp: /^TVqQAAMAAAAEAAAA/ But it seems like some of those .EXEs have different "magic" bytes. This works for me: /^TV[qp]QAA[MI]AAAAEAA[A8]A/ You can change this in EvalTests.pm, line 2413. Cheers, Malte ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
