> COMBOFORGINGVIRUS combo FIVETENKLEZ,FORGINGVIRUSFILTER 0 0
Maybe it would be bether to define two seprate filter files for MAILFROM and BODY and the set up the COMBO test that it must match both a MAILFROM and BODY phrase: ========================================== MAILFROM 0 contains <> MAILFROM 0 contains postmaster@ MAILFROM 0 contains mailer-daemon@ ========================================== ========================================== BODY 0 contains readme.pif BODY 0 contains Klez BODY 0 contains MyDoom BODY 0 contains Sobig BODY 0 contains Sober ========================================== COMBOFORGINGVIRUS combo FIVETENKLEZ,FORGINGVIRUSBODY,FORGINGVIRUSMAILFROM 0 0 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
