On Saturday 07 February 2004 19:02, Jens Benecke wrote:
> Hi,
>
> just saw this:
>
> ...
> X-Kaspersky-Antivirus: passed
> X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on
> kiste.hitchhikers.de
> X-Spam-Status: No, hits=0.0 required=5.0 tests= autolearn=no
> version=2.63 X-Spam-Level:
>
> =dd=f4=f4=e5=ea=f2=e8=e2=ed=e0=ff =f0=e0=f1=ea=f0=f3=f2=ea=e0 =e8
> =e4=e5= =e9=f1=f2=e2=e5=ed=ed=e0=ff =f0=e5=ea=eb=e0=ec=ed=e0=ff
> =ef=ee=e4=e4=e5=f0= =e6=ea=e0 =c2=e0=f8=e5=e3=ee
> =e1=e8=e7=ed=e5=f1=e0: =c1=fb=f1=f2=f0=ee =e8= =ef=f0=ee=f1=f2=ee!
>
> does a new rule for that kind of trash make sense?
Try:
rawbody ALL_QUOTES /(=[a-f0-9]{2}){5,}/i
describe ALL_QUOTES Five or more quotes in a row.
score ALL_QUOTES 1.0
Tweak the {5,} to be more or less to suit you, and obviously the score.
Is the "correct" way 'body' or 'rawbody'? Anybody have any ham that
matches this?
--
Berend De Schouwer
