EXE Files Slipping Through

[Peter Nitschke]

I was catching them with SA too, but I just did a fresh PC install with MS,
SA and everything using the Yum system, and it's catching them with clamav
where my older but updated server isn't.

Something with the way Clam is being used by the looks, but I don't have
time to mess around to find out why.

Peter


*********** REPLY SEPARATOR  ***********

On 23/08/2008 at 2:24 PM Randal, Phil wrote:

>But those are so easily caught by SpamAssassin!
>
>Which is what I resorted to doing.
>
>Cheers,
>
>Phil 
>
>-----Original Message-----
>From: mailscanner-bounces at lists.mailscanner.info
>[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jon
>Bates
>Sent: 23 August 2008 13:28
>To: mailscanner at lists.mailscanner.info
>Subject: EXE Files Slipping Through
>
>Im hoping someone can help me here.
>
>By using filename and filetype exceptions I've allowed myself to send
>and receive .exe files. I've banned this for all other addresses though.
>The reason for this is that it catches a huge amount of malware that
>slips through Clamav/Sophos - at the moment its hundreds of "Fedex
>tracking number" emails with a zipped exe attachment that aren't being
>detected!
>
>My problem is when malware emails arrive which are addressed to me AS
>WELL as other people - This means the infected email is actually
>delivered to the other people on the email! Is this normal behaviour?
>I'm smart enough not to open these emails, but other people are not!
>
>Is there any way to stop this behaviour without me losing my ability to
>send/receive EXE files?
>
>Cheers!
>
>--
>MailScanner mailing list
>mailscanner at lists.mailscanner.info
>http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>Before posting, read http://wiki.mailscanner.info/posting
>
>Support MailScanner development - buy the book off the website! 
>-- 
>MailScanner mailing list
>mailscanner at lists.mailscanner.info
>http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>Before posting, read http://wiki.mailscanner.info/posting
>
>Support MailScanner development - buy the book off the website!