Hi, are there any rules to avoid sven messages ? bye steph
It's not really the point of SA, however Andreas Kotowicz posted a list of rules that appear to work well.
My only criticism of this ruleset is that he forgot to name all the sub-rules starting with double-underscore, so MDS_Swen_A_* get 1 point each.
I would however suggest adding clamav, or another virus scanner as the best way of detecting these.
In any event, here's his rules (note: be sure to undo line wraps)
header MDS_Swen_A_0 From =~ /(email|inet|internet|mail|microsoft|ms|net|network)/i header MDS_Swen_A_1 From =~ /(section|service|system)/i header MDS_Swen_A_2 From =~ /^\s*(admin|administrator)\s*$/i header MDS_Swen_A_3 Subject =~ /^\s*(advice|announcement|failure\s+report|letter|mail|notice|report)\s*$/i header MDS_Swen_A_4 Subject =~ /^\s*(abort|bug|error)\s+\S+/i header MDS_Swen_A_5 Subject =~ /^.*\s+(advice|announcement|letter|message|notice)\s*$/i header MDS_Swen_A_6 Subject =~ /^\s*(mail:\s+|message|(returned|undeliverable|undelivered)\s+(mail|message))/i header MDS_Swen_A_7 Subject =~ /^\s*$/ header MDS_Swen_A_8 Subject =~ /^(critical|current|internet|last|latest|microsoft|net|network|new|newest|security)\s+/i header MDS_Swen_A_9 Subject =~ /^.*\s+(pack|patch|update|upgrade)/i meta MDS_Swen_A ((( MDS_Swen_A_0 && MDS_Swen_A_1 ) || MDS_Swen_A_2 ) || ( MDS_Swen_A_3 || ( MDS_Swen_A_4 && MDS_Swen_A_5 ) || MDS_Swen_A_6 || MDS_Swen_A_7 ) || ( MDS_Swen_A_8 && MDS_Swen_A_9 )) describe MDS_Swen_A MDS - Swen A worm score MDS_Swen_A +10.0
#quick scoring bugfixes by mk: score MDS_Swen_A_0 0.01 score MDS_Swen_A_1 0.01 score MDS_Swen_A_2 0.01 score MDS_Swen_A_3 0.01 score MDS_Swen_A_4 0.01 score MDS_Swen_A_5 0.01 score MDS_Swen_A_6 0.01 score MDS_Swen_A_7 0.01 score MDS_Swen_A_8 0.01 score MDS_Swen_A_9 0.01
------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
