Matt Kettler wrote on Tue, 09 Mar 2004 16:34:32 -0500:
> You mean like this standard rule from SA 2.50 and higher?
>
> header FROM_NO_LOWER From !~ /[a-z]/
> describe FROM_NO_LOWER 'From' has no lower-case characters
>
No, he means FROM: instead of the standard From:
It's very typical for several viruses to use FROM:, TO: and SUBJECT: If
you look at those messages, it's the first thing that stands out. I've
never seen that in any other messages, although there may be a few clients
which do this. But it certainly is a good virus sign if you don't use a
virus scanner or want to flag these messages as spam, anyway.
Kai
--
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services:
http://www.conactive.com IE-Center:
http://ie5.de &
http://msie.winware.org