Matt Kettler wrote on Tue, 09 Mar 2004 16:34:32 -0500: > You mean like this standard rule from SA 2.50 and higher? > > header FROM_NO_LOWER From !~ /[a-z]/ > describe FROM_NO_LOWER 'From' has no lower-case characters >
No, he means FROM: instead of the standard From: It's very typical for several viruses to use FROM:, TO: and SUBJECT: If you look at those messages, it's the first thing that stands out. I've never seen that in any other messages, although there may be a few clients which do this. But it certainly is a good virus sign if you don't use a virus scanner or want to flag these messages as spam, anyway. Kai -- Kai Sch�tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com IE-Center: http://ie5.de & http://msie.winware.org
