MCP not working

[Daniel Eiland]

On Thu, 09 Aug 2007 14:05:04 +0200, Kai Schaetzl <maillists at conactive.com> wrote:
> Daniel Eiland wrote on Thu, 9 Aug 2007 12:30:02 +0200:
> 
>> describe MCP_W32_ZHELATIN_GEN
> 
> 1. your rules all have the same name, only the first (I think) will get
> used. You could condense them, anyway, to something like /received a.*card
> from a/".

Good idea! Thanx.

> 2. why would you use MCP for this? You are trying to catch a bit more spam
> than you normally could with the rules you currently have. So, what you do
> is add extra rules to the ones coming with the distribution. Either from
> sites like www.rulesemporium.com or by dropping your own rules in
> /etc/mail/spammassassin.  Not MCP!

Well, the thing is that these emails are in fact virusses.
http://vil.nai.com/vil/Content/v_142621.htm
But since there's no attachment, it is not scanned by clamav or bitdefender.
They are also not picked up by spamassassin rules. I also use rules_du_jour for fetching all kind of rules.
Getting this particular email in an outlook client makes (some version of) outlook crash.
Clicking the link in this email leads you to a website that will try to use known exploits on your browser.

My idea was to block these messages with MCP and delete them when found.
When i tag them as spam, users get the email in their spambox. Then i still have the risk they open this mail.

When there is a better way of doing this, please let me know.

> 
> I suggest looking at the SA documentation and not just going by the
> MailScanner documentation. The MailScanner documentation will, of course,
> not cover every aspect of the helper applications like SA or Razor or
> whatever ... There's also a good mailing list. *Everyone* using MS and SA
> and being on the MailScanner list should also join the SA list!

Thanx for the advice.

> 
> Kai
> 
> --
> Kai Schätzl, Berlin, Germany
> Get your web at Conactive Internet Services: http://www.conactive.com
> 
> 
> 
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
--
:wq!