> -----Original Message----- > From: Kai Schaetzl [mailto:[EMAIL PROTECTED] > Sent: Wednesday, March 17, 2004 10:32 AM > To: Chris Santerre > Subject: Re: Bigevil and SARE update! If you read only one post this > year, it should be this one > > > Hi Chris, > > I got a MRWIGGLY type spam today which didn't match your > MRWIGGLY rule. I > checked the drugs_diet.cf on your site but it doesn't include > this rule. > So, I'm not sure where it "officially" resides and if I just > use an old > rule. Here's the new rule: > > # Chris Santerre > rawbody __VDRUG1 /^\<html\>\<body\>/ > rawbody __VDRUG2 /^\<center\>\<\!\-\-.{10,25}\-\-\>\<a > href\=\"http\:\/\// > rawbody __VDRUG3 /[a-zA-Z0-9]+\.gif\" border\=0\>\<\/a\>\<\/center\>/ > rawbody __VDRUG4 /^\<\/?body\>\<\/html\>/ > meta MRWIGGLY (__VDRUG1 && __VDRUG2 && __VDRUG3 && __VDRUG4) > describe MRWIGGLY Mr. Wiggly enhance drug spam. > score MRWIGGLY 10.0 > > I changed this match: [a-zA-Z0-9]+\.gif (from [a-zA-Z]\d\.gif) >
But this will only match 1 letter + 1 number .gifs??? Like a2.gif. But not 2a.gif or ksdff23.gif. > spam was: > <html><body> > <center><!--xz7bgpEwOY5gLKG--><a href="http://www.ert5de.com";><img > src="http://www.der4se4r.com/12.gif"; border=0></a></center> > <body></html> > > > Cheers! > > > Kai > > -- > > Kai Sch�tzl, Berlin, Germany > Get your web at Conactive Internet Services: http://www.conactive.com > IE-Center: http://ie5.de & http://msie.winware.org > > >
![http://www.der4se4r.com/12.gif"](http://www.der4se4r.com/12.gif"){kind=link}