Are they being used in a meta rule that auto promotes them?
On 11/21/2011 11:02 AM, [email protected] wrote:
Aren't these not supposed to be published via sa-update? meta T_DKIM_INVALID __DKIM_EXISTS&& !DKIM_VALID mimeheader T_DOS_ZIP_HARDCORE Content-Type =~ /^application\/zip;\sname="hardcore\.zip"$/ body T_EMRCP /\bExcess Maximum Return Capital Profit\b/i meta T_FILL_THIS_FORM_SHORT __FILL_THIS_FORM_SHORT&& !__VIA_ML&& !__MSGID_JAVAMAIL meta T_FORGED_TBIRD_IMG_SIZE __FORGED_TBIRD_IMG&& __ONE_IMG&& __IMG_LE_300K meta T_FRM_SILVER_GOLD (__FRT_SILVER&& __FRT_GOLD) body T_FRT_ADULT2 /<inter W0><post P2>\b(?!adult)<A><D><UX><L><TX>/i $ host -t txt 1.3.3.updates.spamassassin.org 1.3.3.updates.spamassassin.org descriptive text "1195874" $ head -n 1 ../updates_spamassassin_org.cf # UPDATE version 1195874 This stuff is showing up in the rules currently being published for SA v3.3.1. Right?
