> Here is what I whipped up this morning > > header __YM_HF_BEAGLE_K From =~ > /(?:management|administration|staff|noreply|support)\@(?:yourd > omain1|you > rdomain2|yourdomain3)/i > body __YM_B_BEAGLE_K /^(?:dear|hello) user/i > meta YM_BEAGLE_K (__YM_HF_BEAGLE_K && __YM_B_BEAGLE_K) > describe YM_BEAGLE_K Message contains the "Bagle.K/Beagle.K" virus > tflags YM_BEAGLE_K learn > score YM_BEAGLE_K 20.0
This doesn't work for me since some of the accounts it comes from are valid. It does contain a message-id with 11 lower case letters followed by my domain name, but I've been having difficulty in actually making the regex match. Shouldn't this work? /^Message-I[Dd]: <[EMAIL PROTECTED]>$/ Bret
