add blars rules and rules to catch the rtf attachment spam

git-svn-id: svn+ssh://svn.debian.org/svn/pkg-listmaster/trunk/spamassassin_config@340 0b7a5b0c-1f2c-0410-bd74-c376f8064c91

diff --git a/bugs/user_prefs b/bugs/user_prefs
index 31d23b525b29a2efa3293dda8f9521e090fe11f3..df0862b09edeb95329ee159730edf3fe106fd8ea 100644 (file)
--- a/bugs/user_prefs
+++ b/bugs/user_prefs
@@ -56,6 +56,8 @@ bayes_ignore_header X-IronPort-AV
 # blarson 2009-05-22 google spam
 bayes_ignore_header DKIM-Signature
 bayes_ignore_header DomainKey-Signature
+# blarson 2010-02-23
+bayes_ignore_header X-Greylist
 
 
 include bayes_configuration

diff --git a/common/bts_scores b/common/bts_scores
index 605273404768d26131cfc08080522588369083ff..5ac842af68902abd11e88d51e2e1f334040820f3 100644 (file)
--- a/common/bts_scores
+++ b/common/bts_scores
@@ -148,3 +148,9 @@ score MIME_HTML_ONLY 3
 score MIME_HTML_MOSTLY 2
 score HTML_EMBEDS 1
 score HTML_MESSAGE 0.5
+
+# blarson 2010-01-03
+score FH_DATE_PAST_20XX 0
+
+# blarson 2010-01-23
+score USER_IN_DEF_SPF_WL 0.1

diff --git a/common/misc_spam b/common/misc_spam
index 38f69e80f3221aca26e0cd54e55f58c00ff2be6f..a6f31b64fb67758f062e4f7e922803a6e41d44e8 100644 (file)
--- a/common/misc_spam
+++ b/common/misc_spam
@@ -459,8 +459,8 @@ header DOTNET                  subject =~ /Planning a Website Design\? Updates/
 describe DOTNET                   .NET Spam
 score DOTNET              3
 
-# blarson 2009-12-08
-body REMBOX            /\brembox\@/
+# blarson 2010-02-02
+body REMBOX            /\b(?:rembox|disappear|stopping|delrem|remfiles?|exit)\s?\@/
 describe REMBOX                rembox
 score REMBOX           3
 
@@ -474,3 +474,25 @@ header VAULAS              subject =~ /cursos video aulas video/i
 describe VAULAS                some spanish video spam
 score VAULAS           3
 
+# blarson 2010-01-28
+header FROMWWW         from =~ /\bwww\./i
+describe FROMWWW       from www.whatever
+score FROMWWW          3
+
+# blarson 2010-02-16
+header FROMCASINO      from =~ /\bcasino/i
+describe FROMCASINO    from casino
+score FROMCASINO       3
+
+# don 2010-06-10
+header CTOCTET_STREAM  ContentType =~ /octet-stream/i
+describe CTOCTET_STREAM        Content type is octet-stream
+score CTOCTET_STREAM   0.5
+
+header RTF_ATTACH      ContentType =~ /name=.+\.rtf/i
+describe RTF_ATTACH    Contains an RTF Attachment
+score RTF_ATTACH       0.5
+
+meta RTF_SPAM          CTOCTET_STREAM & RTF_ATTACH
+describe RTF_SPAM      Content type is octet-stream and has an RTF Attachment
+score RTF_SPAM         3
\ No newline at end of file