exe extension in url

[Martin Hepworth]

James

Any chance you could modify the rules dir so they are individual ones and
then I can create a RuleDuJour setup for them. Yes I could you update_spam
script, but then I'd have two scripts to do this when I only really one.

--
Martin Hepworth 
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> Behalf Of James Gray
> Sent: 10 January 2006 04:23
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: [MAILSCANNER] exe extension in url
> 
> On Tuesday 10 January 2006 10:33, Matt Kettler wrote:
> > James Gray wrote:
> > > I have written a number of SpamAssassin rules that increase the score
> for
> > > messages that link to executables (exe/dll/bat/etc... but NOT
> > > ".com"...think about it :P).  Unfortunately some of them also hit
> > > legitimate websites (like www.ht.com.au which uses a program called
> > > "xworks.exe" for its dynamic content).
> >
> > Suggestion: use a $ to look for uris that END in .exe, instead of just
> > looking for URIs that contain them. Most dynamic content sites using exe
> > have parameters passed after it, such as the above site which ends in
> > "/xworks.exe?M"
> >
> >
> > Something like this would work:
> >
> >
> > uri L_URI_EXE /\/.+\.exe$/i
> > score L_URI_EXE 0.1
> > describe L_URI_EXE Contains link to a .exe file
> 
> Good suggestion - done.  New tar ball uploaded and change logs edited.
> 
> > > <SHAMELESS_PLUG>
> > > All my rules are available at http://files.grayonline.id.au - all the
> > > URL/URI rules are in the "local_uri.cf" which is in the tar ball.  The
> > > rest of the instructions are on the website.
> > > </SHAMELESS_PLUG>
> >
> > Erm, you don't seem to have them in the 12/02/2005 tarball, which is the
> > latest that's up there.
> 
> Really?  It was in there when I opened it.  Anyway, there's a new tar ball
> dated 10-Jan-2006 that I KNOW has the local_uri.cf file in it.
> 
> Cheers,
> 
> James
> 
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> > Support MailScanner development - buy the book off the website!
> James
> --
> It's hard to argue that God hated Oklahoma.  If He didn't, why is it so
> close to Texas?
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> Support MailScanner development - buy the book off the website!


**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.	

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!