Grreting card scams

[Alex Broens]

On 7/27/2007 12:47 PM, Julian Field wrote:
> 
> 
> Glenn Steen wrote:
>> On 27/07/07, UxBoD <uxbod at splatnix.net> wrote:
>>  
>>> Okay, have done some testing.  For the signature to trigger it has to 
>>> have a source file that contains the message body, and the following 
>>> headers :-
>>>
>>> MIME-Version: 1.0
>>> Content-Type: text/plain;
>>>
>>> otherwise it reports the file as being okay.
>>>     
>>
>> Kind of what I thought... It doesn't understand that it is a mail it
>> is handling.:-(
>>
>> Jules, how would you like to play this one?
>> I suspect that whatever we do might end up being ... less than
>> elegant... Unless you have some inspiration...:-)
>>   
> Yuck.
> I would have to copy the entire message into the scanning directory as 
> well and alter every single parser to look out for it. Nasty job.

Wouldn't the ClamAV SA plugin catch these?
for those using clamd its trivial to implement.

maybe that plugin could be hacked to use the clam module instead.

Alex