Dear Bats Just thought I would share this in case anyone else finds useful. I am getting a large amount of spam with just a PDF attachment (a worm) and a blank email
here is a bit of regex that catches them Message Source *matches* -+[0-9]+\r\n(?:[a-zA-Z\-]+: [^\r]+\r\n)+(?:\r\n){1,}-+[0-9]+\r\n(?:[a-zA-Z\-]+: [^\r]+\r\n)*Content-Type: application/pdf; (detects blank messages with a pdf attachment) As an alternative the filter copy is $$$$ TB! Message Filter $$$$ beginFilter UID: [FD469CA0.01C7C58C.1608C81C.1E42DC91] Name: New\20filter Filter: {\0D\0A\20`6`2`-+[0-9]+/5Cr/5Cn(?:[a-zA-Z/5C-]+:\20[^/5Cr]+/5Cr/5Cn)+(?:/5Cr/5Cn){1,}-+[0-9]+/5Cr/5Cn(?:[a-zA-Z/5C-]+:\20[^/5Cr]+/5Cr/5Cn)*Content-Type:\20application/2Fpdf;\0D\0A} SetMemo Text blankPDF\0D\0A IsActive Ignore endFilter -- Aubrey Windows : Windows XP Service Pack 2 Build 2600 Bat Version 3.51.10 ________________________________________________ Current version is 3.99 | 'Using TBUDL' information: http://www.silverstones.com/thebat/TBUDLInfo.html