Given the huge rise in BASE64 encoded message text I've seen, matching BODY on decoded message text would be welcome indeed. Likewise, I've seen a few (rare) false positives when BODY matched "text" within an attachment.
Not that I'm trying to re-invent Declude Virus, but what I found was that: BODY 0 CONTAINS name=dwarf_4_you.exe Was clearly preferable to: BODY 0 CONTAINS dwarf_4_you.exe To catch one possible Hybris manifestation. (I've inserted the underscores, as usual...) Andrew 8) -----Original Message----- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Thursday, January 16, 2003 11:36 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Is a BASE64 attachment considered body? <snip> We are planning to add basic base64 decoding to an upcoming release, though, so it can't hurt to add the "BODY 15 CONTAINS APPLE" line(s) now.<snip> --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
