worm emails marked as possible spam

[Dave]

On Thu, Dec 01, 2005 at 01:27:04PM -0500, Jeff A. Earickson wrote:
> This sounds like the problem of ClamAV not catching Sober.U/Sober-Z
> with ClamAV 0.87.1, check the list archives from earlier this week.
> I changed to the latest CVS version of Clam and the problem went
> away.  I'm totally baffled as to why Clam hasn't put out a new release
> to fix this nasty bug.
> 
> Jeff Earickson
> Colby College
>

Clamav is up to date.

Look at:

http://doctor.nl2k.ab.ca/cgi-bin/virus/display.pl?number
 
> On Thu, 1 Dec 2005, IT Dept wrote:
> 
> >Date: Thu, 1 Dec 2005 09:15:22 -0800
> >From: IT Dept <itdept at FRACTALWEB.COM>
> >Reply-To: MailScanner mailing list <MAILSCANNER at JISCMAIL.AC.UK>
> >To: MAILSCANNER at JISCMAIL.AC.UK
> >Subject: worm emails marked as possible spam
> >
> >Hi Everyone,
> >
> >I'm getting tons of complaints from my users that are complaining about 
> >the amount of "spam" they're getting over the past week or so. These are 
> >messages with subjects such as "hi, ive a new mail address" and so forth. 
> >Obviously, it's not really spam, but the result of one of the Sober worm 
> >variants. But the problem is that although SOME of the messages get tagged 
> >as high spam, and therefore the users aren't notified...many of the 
> >messages don't score high enough for that, so get tagged as possible spam 
> >and the user's inbox gets bigger...some users are apparently getting 
> >hundreds of these a day.
> >
> >How do I block these damned things, or at least not have the system notify 
> >my users about them?
> >
> >Thanks,
> >Chris
> >
> >------------------------ MailScanner list ------------------------
> >To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> >'leave mailscanner' in the body of the email.
> >Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> >Support MailScanner development - buy the book off the website!
> >
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> Support MailScanner development - buy the book off the website!
> 
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> 

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!