On Thu, Aug 21, 2003 at 01:32:58PM -0500, Andrew Edelstein wrote:
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
I doubt any OE client uses that format :)
And you would be wrong. That's the version (6) of OE installed with Windows XP
("Build 2600")
I stand corrected. I just came across a legit message with that
header. It also contained:
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
...which is not present in any copies of the virus I've seen.
So maybe:
:0
* ^X-MailScanner: Found to be clean
* ^Date:.*\-\-[0-9][0-9][0-9][0-9]$
* ^X-Mailer: Microsoft Outlook Express 6.00.2600.0000
* ! ^X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
* ^Subject: (Re: )+(((My|Your) )?Details|Approved|\
Thank you\!|That movie|Wicked screensaver|Your application)
{ whatever }
--
Robert Arnold
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail