> I tried your "body" test and it did NOT catch that email! May be it will > catch the redistribution mails that are sent after a machine has > caught the > worm. > > Best Regards > Andy Schmidt
I filtered on F r i e n d - g r e e t i n g s . c o m (without the spaces) because of the copy of this e-mail that was posted to the Imail forum on friday 11/08/02. http://www.mail-archive.com/imail_forum@;list.ipswitch.com/msg60464.html Since your post, I checked other examples of the message - those examples do not have the hyphen in the domain name. So, my frndgrt.txt looks like this now: ----------------------------------------------------- BODY 0 CONTAINS F r i e n d - G r e e t i n g s . c o m (without the spaces) BODY 0 CONTAINS F r i e n d G r e e t i n g s . c o m (without the spaces) Sorry about that! Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
