Grreting card scams

[Rick Cooper]

 > -----Original Message-----
 > From: mailscanner-bounces at lists.mailscanner.info 
 > [mailto:mailscanner-bounces at lists.mailscanner.info] On 
 > Behalf Of Matt Kettler
 > Sent: Thursday, July 26, 2007 5:30 PM
 > To: MailScanner discussion
 > Subject: Re: Grreting card scams
 > 
 > 
 > 
 > UxBoD wrote:
 > > Then if one of those emails has been quarantined as SPAM, 
 > what happens if you run clamscan against the quarantined file?
 > 
 > I don't quarantine spam. I tag only.
 > 
 > However, If I copy one of the messages back onto the server 
 > and scan it with
 > clamscan, clamscan does detect it as a virus.
 > 
 > However, none of them have ever been detected as a virus 
 > while going through
 > MailScanner. Ever. (I just searched all my postmaster 
 > notices from MailScanner
 > and the word "You've" doesn't appear in any of them, which 
 > would be part of the
 > subject-line quite.).
 > 
 > Note that my MailScanner setup does detect phishing signatures.
 > 
 > ie:
 >     Report: ClamAV: msg-9454-234.html contains HTML.Phishing.Pay-36
 >     Report: ClamAV: msg-17765-74.html contains Email.Phishing.RB-1260
 > 
 > But there are no Email.Phishing.RB-1222's in there anywhere.
 > 

What do you get if you run

sigtool --list-sigs|grep Email.Phishing.RB-1222

Perhaps something amiss with the clamdb updates? Accidental dupe installs?

Rick


 > -- 
 > MailScanner mailing list
 > mailscanner at lists.mailscanner.info
 > http://lists.mailscanner.info/mailman/listinfo/mailscanner
 > 
 > Before posting, read http://wiki.mailscanner.info/posting
 > 
 > Support MailScanner development - buy the book off the website! 
 > 
 > --
 > This message has been scanned for viruses and
 > dangerous content by MailScanner, and is
 > believed to be clean.
 > 
 > 


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.