This morning's Trojan

[Mail Admin]

Thank you for this.

Much appreciated

Kevin

 

From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Randal,
Phil
Sent: 22 August 2008 11:12
To: MailScanner discussion
Subject: RE: This morning's Trojan

 

Just chuck them into a local.cf (or whatever name you choose) in
/etc/mail/spamassassin

 

Then reload MailScanner to pick up the changes.

 

ClamAV is now detecting this one as Trojan.Agent-42387

 

Cheers,


Phil

-- 
Phil Randal 
Networks Engineer 
Herefordshire Council 
Hereford, UK 

 

 

  _____  

From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Mail Admin
Sent: 22 August 2008 11:01
To: 'MailScanner discussion'
Subject: RE: This morning's Trojan

Hi Phil

 

How do you write your own rules in SA?

 

Regards

 

Kevin

 

From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Randal,
Phil
Sent: 22 August 2008 08:01
To: mailscanner at lists.mailscanner.info
Subject: This morning's Trojan

 

Hi folks,

 

The one to catch has a subject line of "Statement of fees 2008/09"

 

SA rule to get it is

 

header   MY_TROJAN8     Subject =~ /^Statement of fees 2008\/09$/
describe MY_TROJAN8     Fees trojan
score    MY_TROJAN8     12

Samples submitted to the usual places.

 

Phil

This message has been scanned for viruses and dangerous content by
<http://www.mailscanner.info/> MailScanner, and is believed to be clean.

This e-mail is intended solely for the addressee(s) and is strictly
confidential. The unauthorised use, disclosure or copying of this e-mail, or
any information it contains is prohibited. If you have received this e-mail
in error, please notify us immediately and then permanently delete it.
Although we make every effort to keep our systems free from viruses, you
should check this e-mail and any attachments to it for viruses as we cannot
accept any liability for viruses inadvertently transmitted by use.

This message has been scanned for viruses and dangerous content by
<http://www.mailscanner.info/> MailScanner, and is believed to be clean.


This e-mail is intended solely for the addressee(s) and is strictly confidential. The unauthorised use, disclosure or copying of this e-mail, or any information it contains is prohibited. If you have received this e-mail in error, please notify us immediately and then permanently delete it. Although Midland Internet & Computer Solutions make every effort to keep our systems free from viruses you should check this e-mail and any attachments to it for viruses as we cannot accept any liability for viruses inadvertently transmitted by use.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20080822/da3c63ad/attachment.html