You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jm...@apache.org on 2008/04/16 11:25:52 UTC
svn commit: r648638 - /spamassassin/rules/trunk/sandbox/jm/20_basic.cf
Author: jm
Date: Wed Apr 16 02:25:51 2008
New Revision: 648638
URL: http://svn.apache.org/viewvc?rev=648638&view=rev
Log:
add a description for JM_REACTOR_MAILER
Modified:
spamassassin/rules/trunk/sandbox/jm/20_basic.cf
Modified: spamassassin/rules/trunk/sandbox/jm/20_basic.cf
URL: http://svn.apache.org/viewvc/spamassassin/rules/trunk/sandbox/jm/20_basic.cf?rev=648638&r1=648637&r2=648638&view=diff
==============================================================================
--- spamassassin/rules/trunk/sandbox/jm/20_basic.cf (original)
+++ spamassassin/rules/trunk/sandbox/jm/20_basic.cf Wed Apr 16 02:25:51 2008
@@ -293,9 +293,10 @@
header __JM_REACTOR_XMOLE X-MimeOLE =~ /^Produced By Microsoft MimeOLE V6.00.2900.3198$/
#
meta JM_REACTOR_MAILER (__JM_REACTOR_MID && __JM_REACTOR_DATE && __JM_REACTOR_XM2900 && __JM_REACTOR_XMOLE)
-
+describe JM_REACTOR_MAILER Header patterns indicative of "Reactor Mailer" ratware
# spotted in the SOUGHT rules
body MSHTML_6_00_2900_3199_A /> <META content=3D\"MSHTML 6\.00\.2900\.3199\" name=3DGENERATOR> /
body MSHTML_6_00_2900_3199_B /> <META content=3D\"MSHTML 6\.00\.2900\.3199\" name=3DGENERATOR> /
body MSHTML_6_00_2900_3199_C /<META content=3?D?\"MSHTML 6\.00\.2900\.3199\" name=3?D?GENERATOR>/
+