spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Mike Grau <m.g...@kcc.state.ks.us>
Subject Re: KB_FAKED_THE_BAT
Date Mon, 14 May 2012 21:00:22 GMT

>>
>> # grep Date: HEADERS | od -a
>> 0000000   D   a   t   e   :  sp  ht   T   h   u   ,  sp   3  sp   M   a
>> 0000020   y  sp   2   0   1   2  sp   1   6   :   5   3   :   5   9  sp
>> 0000040   +   0   7   0   0  nl
>> 0000046vi H*
>>
>> This has been Russian language spam (charset koi8-r) with various
>> flavors of X-Mailer: The Bat!
> 
> What version of SpamAssassin are you running?  Here's a note from that
> rule's definition (rulesrc/sandbox/kb/20_header.cf):
> 
> # NOTE  Depends on some header rule code fixes for 3.3.x to remove
> #       the leading space that was showing up in header rules.  For
> #       3.2.x releases the pattern must be changed to /^ \t/.
> 
> Karsten:  Maybe change it to   /^ ?\t/   as a workaround?
> (Yes, I know we've stopped supporting sa3.2.x)

In 3.3.2
/var/lib/spamassassin/3.003002/updates_spamassassin_org
# grep  __KB_DATE_CONTAINS_TAB 72_active.cf

header   __KB_DATE_CONTAINS_TAB  Date:raw =~ /^\t


Mime
View raw message