You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@spamassassin.apache.org by jm...@apache.org on 2007/10/27 21:19:18 UTC

svn commit: r589187 - /spamassassin/rules/trunk/sandbox/jm/20_basic.cf

Author: jm
Date: Sat Oct 27 12:19:18 2007
New Revision: 589187

URL: http://svn.apache.org/viewvc?rev=589187&view=rev
Log:
bug 5704: add a test rule (BUG5704_PUMP_N_DUMP_RATWARE) and another for a web rule to catch Gozi PDFs (DVLABS_GOZI_PDF)

Modified:
    spamassassin/rules/trunk/sandbox/jm/20_basic.cf

Modified: spamassassin/rules/trunk/sandbox/jm/20_basic.cf
URL: http://svn.apache.org/viewvc/spamassassin/rules/trunk/sandbox/jm/20_basic.cf?rev=589187&r1=589186&r2=589187&view=diff
==============================================================================
--- spamassassin/rules/trunk/sandbox/jm/20_basic.cf (original)
+++ spamassassin/rules/trunk/sandbox/jm/20_basic.cf Sat Oct 27 12:19:18 2007
@@ -258,3 +258,11 @@
 
 body JM_NICE_GIRL       /I am nice girl that would like to chat with you\. /
 
+# http://dvlabs.tippingpoint.com/blog/2007/10/26/stopgap-detection-for-the-gozi-pdf-dropper
+full DVLABS_GOZI_PDF    /bWFpbHRvOiUvLi4vLi4vLi4vLi4vLi4vLi4v/
+
+# http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5704
+header __EXIM_MTA Received =~ /with esmtp \(Exim \S+\)\s+id \S{6}\-\S{6}\-\S{2}/i
+header __BOGUS_EXIM_PUMP_N_DUMP  Received =~ /with esmtp \(\S+ \S+\)\s+id \S{6}\-\S{6}\-\S{2}/
+meta BUG5704_PUMP_N_DUMP_RATWARE (!__EXIM_MTA && __BOGUS_EXIM_PUMP_N_DUMP)
+