Thank you Benny, I will use this command next time. Sergio
By the way your links are very accurate, that are the spammers that sent the email, with my new rule they are On Tue, Nov 22, 2011 at 3:42 AM, Benny Pedersen <m...@junc.org> wrote: > On Mon, 21 Nov 2011 22:32:42 +0100, Karsten Bräckelmann wrote: > >> >>> =?iso-8859-1?B?**LlZlbnRhIGRlIENBTkFTVEFTIE5BVk** >>> lERdFBUyAtIHB1YmyhY2kgZGFk?= >>> >> >> Not "eval", but encoded -- in this case even necessary, rather than an >> attempt at obfuscation, because it contains non ASCII letters. >> > > yep its base64 encode string between last two ? > > ?B? is the sign of mime header for base64 > > ?Q? qotedprintelble > > but use ripmime :-) > > and create rules from the output >
