This morning's Trojan

[Randal, Phil]

Just chuck them into a local.cf (or whatever name you choose) in
/etc/mail/spamassassin
 
Then reload MailScanner to pick up the changes.
 
ClamAV is now detecting this one as Trojan.Agent-42387
 
Cheers,

Phil

-- 
Phil Randal 
Networks Engineer 
Herefordshire Council 
Hereford, UK 

 

________________________________

From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Mail
Admin
Sent: 22 August 2008 11:01
To: 'MailScanner discussion'
Subject: RE: This morning's Trojan



Hi Phil

 

How do you write your own rules in SA?

 

Regards

 

Kevin

 

From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Randal,
Phil
Sent: 22 August 2008 08:01
To: mailscanner at lists.mailscanner.info
Subject: This morning's Trojan

 

Hi folks,

 

The one to catch has a subject line of "Statement of fees 2008/09"

 

SA rule to get it is

 

header   MY_TROJAN8     Subject =~ /^Statement of fees 2008\/09$/
describe MY_TROJAN8     Fees trojan
score    MY_TROJAN8     12

Samples submitted to the usual places.

 

Phil

This message has been scanned for viruses and dangerous content by
MailScanner <http://www.mailscanner.info/> , and is believed to be
clean.

This e-mail is intended solely for the addressee(s) and is strictly
confidential. The unauthorised use, disclosure or copying of this
e-mail, or any information it contains is prohibited. If you have
received this e-mail in error, please notify us immediately and then
permanently delete it. Although we make every effort to keep our systems
free from viruses, you should check this e-mail and any attachments to
it for viruses as we cannot accept any liability for viruses
inadvertently transmitted by use.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20080822/5dacd309/attachment.html