Score on attachments

[Max Kipness]

>What about not allowing messages with forbidden attachments through at all? 
>In any case, you might want to try something like this:
>mimeheader SCR_ATTACHED Content-Type =~ /scr/i
>describe SCR_ATTACHED email contains an scr file attachment
>score SCR_ATTACHED 1.0

I actually spoke a little soon.

Although this works great on the actual SCR files. I realized later they are sent inside of zip files. This doesn't work for an SCR inside of a zip, of course because the mime header has no mention of the inside file.

For now I'm giving zip files a low score, but enough to take the email to definite "is spam" with a Bayes 999.

I'm also reviewing Rick's suggestion.

Thanks all,
Max