I did up a real quick and dirty on Friday to keep them out of our network. We block high scores, so this made sure no one (else) got it in their inbox. I set the score to 150 to overcome any white lists.
header YOURACCOUNTH Subject =~ /^your account / describe YOURACCOUNTH Possible virus subject score YOURACCOUNTH 150.0 -cpc- --- -----Original Message----- From: Chapman, Matt [mailto:[EMAIL PROTECTED] Sent: Monday, August 04, 2003 8:46 AM To: [EMAIL PROTECTED] Subject: [SAtalk] Your account worm Hi, Anyone have anything as far as a rule for blocking the latest microsoft worm that comes as a mail from and admin of your domain and (so far the header is X-Mailer: The Bat!(v1.61)) Claims that your account is about to expire with a message.zip attached. Rules? -Matt Chapman -- Matt Chapman Network Engineer Orange County Public Schools "Take advantage of the enemy's unreadiness, make your way by unexpected routes, and attack unguarded spots." -Sun Tzu --- The information contained in this e-mail message is intended solely for the recipient(s) and may contain privileged information. Tampering with or altering the contents of this message is prohibited. This information is the same as any written document and may be subject to all rules governing public information according to Florida Statutes. Any message that falls under Chapter 119 shall not be altered in a manner that misrepresents the activities of Orange County Public Schools. [References: Florida State Constitution I.24, Florida State Statutes Chapter 119, and OCPS Management Directive A-9.] If you have received this message in error, or are not the named recipient notify the sender and delete this message from your computer. ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
