Boy are you in luck. Since that is a text attachment rather than a binary
attachment (as the original virus would have been ) SA didn't strip the mime
informaiton out that you need.
This is untested, but should work if I didn't make any stupid errors:
full VIRUS_DELETED =~ /Content-Disposition\: attachment;
filename=\"DELETED0\.TXT\"/i
Mind the wrap on that. There are spaces before 'attachment' and 'filename'.
Loren
----- Original Message -----
From: "David Groce" <[EMAIL PROTECTED]>
To: "Spam Assassin List" <[EMAIL PROTECTED]>
Sent: Wednesday, May 26, 2004 2:01 PM
Subject: Rule for deleted virus attachments
> Seeing as how I am a regular expression dummy, I was wondering if anyone
has
> written or could write a rule that would score on e-mail with attachments
> called Deleted0.txt
>
> We've got an antivirus gateway that very effectively strips viral
> attachments, but there are no options to drop those messages. My users
> complain that spam still gets through, when it's actually the viruses
(that
> have been cleaned and replaced with a txt file called Deleted0.txt)
>
> Please help.
>
> -David
>
