On Tue, Sep 23, 2003 at 03:42:56PM +0200, Malte S. Stretz wrote: > On Tuesday 23 September 2003 13:21 CET Garret Brady wrote: > > I'm using spamassassin 2.55 direct from procmail on a PII450 > > running .rh8.0. I notice that mails with dos executables > > get through, even though I've the line > > > > score MICROSOFT_EXECUTABLE 5.0 > > > > in my ~/.spamassassin/user_prefs file. Other rules in the > > file work fine. > > Jepp, the rule is slightly broken, especially for those "use this patch now" > worms. It currently uses this RegExp: > /^TVqQAAMAAAAEAAAA/ > But it seems like some of those .EXEs have different "magic" bytes. This > works for me: > /^TV[qp]QAA[MI]AAAAEAA[A8]A/ > but why did it change from 2.55 i mean if it's not broken why change it?
> > > > ------------------------------------------------------- > This sf.net email is sponsored by:ThinkGeek > Welcome to geek heaven. > http://thinkgeek.com/sf > _______________________________________________ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
