Grreting card scams

[Glenn Steen]

On 27/07/07, Alex Broens <ms-list at alexb.ch> wrote:
> On 7/27/2007 12:47 PM, Julian Field wrote:
> >
> >
> > Glenn Steen wrote:
> >> On 27/07/07, UxBoD <uxbod at splatnix.net> wrote:
> >>
> >>> Okay, have done some testing.  For the signature to trigger it has to
> >>> have a source file that contains the message body, and the following
> >>> headers :-
> >>>
> >>> MIME-Version: 1.0
> >>> Content-Type: text/plain;
> >>>
> >>> otherwise it reports the file as being okay.
> >>>
> >>
> >> Kind of what I thought... It doesn't understand that it is a mail it
> >> is handling.:-(
> >>
> >> Jules, how would you like to play this one?
> >> I suspect that whatever we do might end up being ... less than
> >> elegant... Unless you have some inspiration...:-)
> >>
> > Yuck.
> > I would have to copy the entire message into the scanning directory as
> > well and alter every single parser to look out for it. Nasty job.
>
> Wouldn't the ClamAV SA plugin catch these?
> for those using clamd its trivial to implement.
>
> maybe that plugin could be hacked to use the clam module instead.
>
> Alex
>
You've got a link to share on that one Alex (yeah, I'm exceptionally
lazy today... It's Firday afternoon (here), after all:-)?

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se