(sigh) Keyboard virus... I should have had an underscore in *both* of the entries. To recap I'll reproduce here with an underscore inserted to get around my own filter:
#Dec-02-2002 AC Very common in Chinese hosted spamvertisement # "unsubscribe" footers BODY 0 CONTAINS bta_mail.net.cn And the "verbatim" spam snippet with an underscore inserted: <FONT face=verdana color=#800000 size=3><STRONG>Unsubscribe at: [EMAIL PROTECTED]</STRONG></FONT> ******</BODY></HTML> And the symptom was that this line in my filter text didn't fire on an actual spam but did fire on a follow-up test (and my message to this list when I neglected to insert *both* underscores). Andrew 8) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
