how to wirte this kind of mcp rule

[Julian Field]

On Sun23 Jul 06, at 15:31, ankush grover wrote:

> On 7/23/06, Julian Field <MailScanner at ecs.soton.ac.uk> wrote:
>>
>> On Sun23 Jul 06, at 12:42, ankush grover wrote:
>>
>> > hey friends,
>> >
>> > I am using Postfix with MailScanner. For last 2 or 3 days I am
>> > receiving lot of Spam a particular spam header or subject is
>> > "VlzAGRA". This word is not alone in the header or subject there  
>> are
>> > other words with it like "Re: efasfd VlzAGRA" it is become  
>> difficult
>> > to add every subject coming with " VlzAGRA" to mcp list. How do I
>> > write a mcp rule in such a way if there is a subject which contains
>> > "VlzAGRA"   it should be marked as spam.
>> >
>> > I have written below rules but still I am getting the mails with
>> > subject  "VlzAGRA" or "Re: VlzAGRA" in it.
>> >
>> > header   RULE26         Subject =~ /VlzAGRA/i
>> > describe RULE26         Banned Subject
>> > score    RULE26         10
>> >
>> > header   RULE27         Subject =~ /Re:zakeg VlzAGRA/i
>> > describe RULE27         Banned Subject
>> > score    RULE27         10
>> >
>>
>> header RULE28   Subject =~ /VisAGRA/
>>
>> is all you need.
>>
> hey,
>
> Thanks for the reply. But if the subject is "Re:epykg VIzAGRA" then it
> is not getting banned.
>
> What you have told me is already there in my rules set and I had only
> put "i" at the end to make it case insensitive.
>
> What I want to know is how to stop any mail if the mail contains
> "VIzAGRA" as one of the words in the subject ?

You still need to add the "describe" and "score" lines as well, for  
it to be recognised and used by SpamAssassin. Give it a large score  
(e.g. 1000) and make sure your High Scoring Spam Actions include  
"delete" so that it gets removed by MailScanner.

Sorry if that lot wasn't clear in my previous email, I didn't write  
the message very well :-(

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store !
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654



-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.