bagle SpamAssassin rule [SCANNED]

[Matthew Day]

Dustin Baer wrote:
> It works for me.  I had to increase the score, since BAYES_00 was
> basically erasing the 6.5 I gave it.

David Vosburgh wrote:
>I tried it briefly but was getting more false positives than legitimate
>hits.  The problem seemed to be primarily caused by phone numbers
>(specifically, the last four digits) included in the senders signature
>coming after "password".  That ".*" is pretty aggressive ;-).


Taking these on-board; the following seems to be working for us:

body     BAGLE_PASSWORD /pass.{0,15}[0-9]{4,}/i
describe BAGLE_PASSWORD Looks like Bagle virus
score    BAGLE_PASSWORD 11


Matthew Day
University of Buckingham