This morning's Trojan

Randal, Phil prandal at
Fri Aug 22 11:11:50 IST 2008

Just chuck them into a (or whatever name you choose) in
Then reload MailScanner to pick up the changes.
ClamAV is now detecting this one as Trojan.Agent-42387


Phil Randal 
Networks Engineer 
Herefordshire Council 
Hereford, UK 



From: mailscanner-bounces at
[mailto:mailscanner-bounces at] On Behalf Of Mail
Sent: 22 August 2008 11:01
To: 'MailScanner discussion'
Subject: RE: This morning's Trojan

Hi Phil


How do you write your own rules in SA?






From: mailscanner-bounces at
[mailto:mailscanner-bounces at] On Behalf Of Randal,
Sent: 22 August 2008 08:01
To: mailscanner at
Subject: This morning's Trojan


Hi folks,


The one to catch has a subject line of "Statement of fees 2008/09"


SA rule to get it is


header   MY_TROJAN8     Subject =~ /^Statement of fees 2008\/09$/
describe MY_TROJAN8     Fees trojan
score    MY_TROJAN8     12

Samples submitted to the usual places.



This message has been scanned for viruses and dangerous content by
MailScanner <> , and is believed to be

This e-mail is intended solely for the addressee(s) and is strictly
confidential. The unauthorised use, disclosure or copying of this
e-mail, or any information it contains is prohibited. If you have
received this e-mail in error, please notify us immediately and then
permanently delete it. Although we make every effort to keep our systems
free from viruses, you should check this e-mail and any attachments to
it for viruses as we cannot accept any liability for viruses
inadvertently transmitted by use.

-------------- next part --------------
An HTML attachment was scrubbed...

More information about the MailScanner mailing list