David Jelinek wrote: > If someone would help me, I would appreciate it. We are getting a lot > of messages that get through that have various subjects bodies etc. > but they all have an attachment of the form xxxinfoxxx.zip although > the zip file really is not there (that's why it doesn't get stopped by > the virus scanner). We are running SpamAssassin version 3.0.2 > > I tried the following rule: > > rawbody L_BAD_ZIP1 /name=".*?info.*?\.zip"/i > score L_BAD_ZIP1 3.0 > describe L_BAD_ZIP1 Mail with stupid *info*.zip att > > to try and catch these but there is no match. > You need to do that as a full rule, not a rawbody. The "rawbody" is still sufficiently cooked that non-text mime segments and mime boundaries are removed.
