Score on attachments

[Paul A Sand]

* Max Kipness <max at inmindlabs.com> [2014-06-27 11:15]:
> I sometimes get spam with attachments that are usually SCR files. For
> example just a few minutes ago I received about 401k fund
> participants/performance. Everything on my MailScanner system is setup
> correctly. I'm using Bayes (manual), Razor, Pyzor, DCC, custom rules,
> you name it. So this message received a Bayes 999, which is correct. But
> nothing else was triggered. I'm looking at some type of custom rule, but
> I sure would be nice if we could score on an attachment present in
> general, or certain extensions like an SCR. Or if we could score on the
> fact that the message was caught by MailScanner with an attachment
> warning.

It’s been awhile since I looked at this, but I was under the impression
that this was covered by normal, uncustomized, rules:

1) MailScanner.conf has

    Filename Rules = %etc-dir%/filename.rules.conf

2) filename.rules.conf has

    deny    \.scr$	Possible virus hidden in a screensaver	Windows Screensavers are often used to hide viruses

But you say that everything is set up correctly, so I’m almost certainly
missing something. 

-- 
-- Paul A Sand <pas at unh.edu>
-- Information Technology / University of New Hampshire
-- http://pubpages.unh.edu/~pas
-- No electrons were harmed in the transmission of this message.