Try using: uri W_TRUSTE_ORG /truste\.org/i score W_TRUSTE_ORG 5.0
This should eliminate them, as it did for me. Though "truste.org" is not a spammer, it is unlikely that you will kill any ham by including this. George > -----Ursprüngliche Nachricht----- > Von: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Im > Auftrag von Jeff Lasman > Gesendet: Freitag, 9. Januar 2004 15:57 > An: [EMAIL PROTECTED] > Betreff: [SAtalk] hits over five yet not marked as spam... > > > We're being hit by MS security update emails. I know they're > not spam, > but rather more accurately described as virii or worms. > > However, I'm wondering if anyone has a good rule that will mark these? > > Thanks. > > Jeff > -- > Jeff Lasman, nobaloney.net, P. O. Box 52672, Riverside, CA > 92517 US Professional Internet Services & Support / > Consulting / Colocation Our blists address used on lists is > for list email only Phone +1 909 324-9706, or see: > "http://www.nobaloney.net/contactus.html> " > > > > > ------------------------------------------------------- > > This SF.net email is sponsored by: Perforce Software. > Perforce is the Fast Software Configuration Management System > offering advanced branching capabilities and atomic changes > on 50+ platforms. Free Eval! > http://www.perforce.com/perforce/loadpro> g.html > > _______________________________________________ > > Spamassassin-talk mailing list [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > ------------------------------------------------------- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advanced branching capabilities and atomic changes on 50+ platforms. Free Eval! http://www.perforce.com/perforce/loadprog.html _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
