worm emails marked as possible spam

[Jeff A. Earickson]

This sounds like the problem of ClamAV not catching Sober.U/Sober-Z
with ClamAV 0.87.1, check the list archives from earlier this week.
I changed to the latest CVS version of Clam and the problem went
away.  I'm totally baffled as to why Clam hasn't put out a new release
to fix this nasty bug.

Jeff Earickson
Colby College

On Thu, 1 Dec 2005, IT Dept wrote:

> Date: Thu, 1 Dec 2005 09:15:22 -0800
> From: IT Dept <itdept at FRACTALWEB.COM>
> Reply-To: MailScanner mailing list <MAILSCANNER at JISCMAIL.AC.UK>
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: worm emails marked as possible spam
> 
> Hi Everyone,
>
> I'm getting tons of complaints from my users that are complaining about the 
> amount of "spam" they're getting over the past week or so. These are messages 
> with subjects such as "hi, ive a new mail address" and so forth. Obviously, 
> it's not really spam, but the result of one of the Sober worm variants. But 
> the problem is that although SOME of the messages get tagged as high spam, 
> and therefore the users aren't notified...many of the messages don't score 
> high enough for that, so get tagged as possible spam and the user's inbox 
> gets bigger...some users are apparently getting hundreds of these a day.
>
> How do I block these damned things, or at least not have the system notify my 
> users about them?
>
> Thanks,
> Chris
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!