Some quick eCard rules: header JARED_ECARD Subject =~ /You\'ve received (a|an) (greeting|postcard| ecard|greeting ecard|greeting card) from a (admirer|class\-mate|colleague| family member|friend|mate|neighbor|neighbour|partner|school friend|school mate|school\-mate|worshipper|Class mate|Colleague|buddy|pal)\!?/i score JARED_ECARD 2.5
header JARED_ECARD1 Subject =~ /^(School\-mate|Worshipper|Neighbour| Colleague|Admirer|School mate|Mate|Class\-mate|Neighbor|Friend|Partner|Family member|Class mate) sent you (a|an) (greeting|postcard|ecard|greeting ecard| greeting card) from ((postcardsfrom|Greeting\-Cards|e\-cards|1LoveCards| postcard|greetingCard|netfuncards|freewebcards|AmericanGreetings| GreetingCards|2000Greetings|FunnyPostcard|mypostcards|egreetings|dgreetings| VintagePostcards|123Greetings|riversongs|Hallmark|greet2k|egreetings| all\-yours|bluemountain|Postcards)\.(com|net|org))\!?/i score JARED_ECARD1 2.0 header JARED_ECARD2 Subject =~ /^(Animated|Funny|Greeting|Holiday|Thank you| Musical|Love|Birthday|Movie\-quality)[\s](ecard|card|postcard)[\s]$/i score JARED_ECARD2 2.0 $0.02, Jared Hall General Telecom, LLC. On Tuesday 14 August 2007 11:33, John Rudd wrote: > Doc Schneider wrote: > > Loren Wilton wrote: > >> PDFinfo plugin from SARE helps a lot with the pdf mess. > > > > I found that ClamAV catches most all those greeting card spamscam > > viruses. > > > > But the PDFInfo from SARE works GREAT! > > ClamAV does even better if you use the Sanesecurity, MSRBL, and MBL > signatures in addition to the main ClamAV signatures. We went from > rejecting a few thousand "viruses" a day with just the base ClamAV > signatures, to rejecting high 10's of thousands of messages a day > (mostly due to Sanesecurity). No complaints about false positives yet.
