> -----Original Message----- > From: Jonathan Vanasco [mailto:[EMAIL PROTECTED] > Sent: Tuesday, September 02, 2003 1:10 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Rule Help Needed > > > > variant on sobig rules, > > I'd like to have a rule for messages without attachments, if > their body > contains "See the attached file for details" > The messages are multipart with one text/plain part > > this would match sobig messages where the virus has failed to attach > itself >
um... body MY_SOBIG /See the attached file for details/i describe MY_SOBIG It is so big I don't know where to store it! I should get lots of false positives here in the future. score MY_SOBIG 10000.01 :-) ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
