Spamassassin rules for Sobig

[B. W. Fitzpatrick]

Add these to your ~/.spamassassin/user_prefs and it will pick up the
Sobig mails and up their score by 5 points (note that it gives 2.5 for
a subject match and 2.5 for a body match to make it more robust and
less likely to flag a false positive).

-Fitz

--------------------8-<-------cut-here---------8-<-----------------------
header HAS_KNOWN_SUBJ_000     Subject =~ 
/(Re:\s*)?((Wicked|That)\s*)?(Approved|Screensaver|Movie)/i
describe HAS_KNOWN_SUBJ_000   Subject has known spam-typical phrases!

header HAS_KNOWN_SUBJ_001     Subject =~ /(Re:\s*)?(Your\s*)?Application/i
describe HAS_KNOWN_SUBJ_001   Subject has known spam-typical phrases!

header HAS_KNOWN_SUBJ_002     Subject =~ /(Re:\s*)(45443-343556|Submited 
\(004756-3463\))/i
describe HAS_KNOWN_SUBJ_002   Subject has known spam-typical phrases!

header HAS_KNOWN_SUBJ_003     Subject =~ /Feel younger, get rid of wrinkles, 
have more energy./i
describe HAS_KNOWN_SUBJ_003   Subject has known spam-typical phrases!

header HAS_KNOWN_SUBJ_004     Subject =~ /(Re:\s*)*((My|Your)\s*)?Details/i
describe HAS_KNOWN_SUBJ_004   Subject has known spam-typical phrases!

header HAS_KNOWN_SUBJ_005     Subject =~ /(Re:\s*)?Thank you!/i
describe HAS_KNOWN_SUBJ_005   Subject has known spam-typical phrases!

full HAS_KNOWN_BODY_000       /(Please\s)?see the attached (zip\s)?file/i
describe HAS_KNOWN_BODY_000   Body has known spam-typical phrases!

# Add your own customised scores for some tests below. The default
# scores are read from the installed spamassassin rules files, but you
# can override them here.  To see the list of tests and their default
# scores, go to http://spamassassin.org/tests.html .
#
# score SYMBOLIC_TEST_NAME n.nn

score HAS_KNOWN_SUBJ_000   2.5
score HAS_KNOWN_SUBJ_001   2.5
score HAS_KNOWN_SUBJ_002   2.5
score HAS_KNOWN_SUBJ_003   2.5
score HAS_KNOWN_SUBJ_004   2.5
score HAS_KNOWN_SUBJ_005   2.5
score HAS_KNOWN_BODY_000   2.5
--------------------8-<-------cut-here---------8-<-----------------------