I can not seem to stop these emails...

[Raymond Dijkxhoorn]

Hi!

> Wow ok , so what am i doing wrong?? here are my rule sets i use....
>
> [ "${TRUSTED_RULESETS}" ] || \
>       TRUSTED_RULESETS="TRIPWIRE EVILNUMBERS SARE_RANDOM ANTIDRUG SARE_ADULT 
> SARE_OEM SARE_BAYES_POISON_NXM \
> SARE_CODING SARE_HEADER SARE_SPECIFIC SARE_BML SARE_FRAUD SARE_SPOOF 
> SARE_REDIRECT_POST300 \
> BOGUSVIRUS SARE_HEADER_ABUSE RANDOMVAL SARE_GENLSUBJ";
>
>
> P.S. How do you test that email with MS or SA, you run a command line thingy 
> or something?

Hmmm .... to stop this thread:

PROLO_LEO1 0.10, PROLO_LEO2 0.10, PROLO_LEO3 0.10, PROLO_LEO4 0.10,
     PROLO_LEO_M1 8.00,

# TEST FOR LEO CRAP

body            PROLO_LEO1              /\85\,45/
body            PROLO_LEO2              /\69\,95/
body            PROLO_LEO3              /\99\,95/
uri             PROLO_LEO4              /http:\/\/.*tripod.com/
meta            PROLO_LEO_M1           (PROLO_LEO1 && PROLO_LEO2 && PROLO_LEO3 && PROLO_LEO4)

score           PROLO_LEO1             0.1
score           PROLO_LEO2             0.1
score           PROLO_LEO3             0.1
score           PROLO_LEO4             0.1
score           PROLO_LEO_M1           8

describe        PROLO_LEO1             Meta Catches all Leo drug variations so far
describe        PROLO_LEO2             Meta Catches all Leo drug variations so far
describe        PROLO_LEO3             Meta Catches all Leo drug variations so far
describe        PROLO_LEO4             Meta to catch Leo now using Tripod
describe        PROLO_LEO_M1           Catches all Leo drug variations so far

Have fun,
Raymond.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!