Headsup - 20_ratware.cf Outlook 2003

[Martin Hepworth]

<x-flowed>
JP

ah yes Michele has moved over to the new stuff.

interesting that one of the newly included rules is causing problems -
mind you we had similar issues with a 2.x rule (the HABEAS signing abuse
by spammers), so nothing new I suppose.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Jan-Peter Koopmann wrote:
>>my ratware says..
>
>
> I think he was referring to SA3 and the 20_ratware.cf there. And that
> version says
>
> # Outlook versions that usually use "dollar signs"
> header __OUTLOOK_DOLLARS_MUA    X-Mailer =~ /^Microsoft Outlook(?: 8|
> CWS, Build 9|, Build 10)\./
> header __OUTLOOK_DOLLARS_OTHER  MESSAGEID =~ /^<\!\~\!/m
> meta __FORGED_OUTLOOK_DOLLARS   (__OUTLOOK_DOLLARS_MUA &&
> !__OUTLOOK_DOLLARS_MSGID && !__OUTLOOK_DOLLARS_OTHER && !__IMS_MSGID &&
> !_
> _UNUSABLE_MSGID)
>
> # use new meta rules to implement FORGED_MUA_OUTLOOK rule from 2.60
> meta FORGED_MUA_OUTLOOK         (__FORGED_OE ||
> __FORGED_OUTLOOK_DOLLARS)
> describe FORGED_MUA_OUTLOOK     Forged mail pretending to be from MS
> Outlook
>
>
> etc.
>
> Regards,
>   JP
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>