Score on attachments

[Max Kipness]

>>* Max Kipness <max at inmindlabs.com> [2014-06-27 11:15]:
>> I sometimes get spam with attachments that are usually SCR files. For
>> example just a few minutes ago I received about 401k fund
>> participants/performance. Everything on my MailScanner system is
setup
>> correctly. I'm using Bayes (manual), Razor, Pyzor, DCC, custom rules,
>> you name it. So this message received a Bayes 999, which is correct.
But
>> nothing else was triggered. I'm looking at some type of custom rule,
but
>> I sure would be nice if we could score on an attachment present in
>> general, or certain extensions like an SCR. Or if we could score on
the
>> fact that the message was caught by MailScanner with an attachment
>> warning.

>It's been awhile since I looked at this, but I was under the impression
>that this was covered by normal, uncustomized, rules:
>
>1) MailScanner.conf has
>
>   Filename Rules = %etc-dir%/filename.rules.conf
>
>2) filename.rules.conf has
>
>    deny    \.scr$	Possible virus hidden in a screensaver	Windows
Screensavers are often used to hide viruses
>
>But you say that everything is set up correctly, so I'm almost
certainly
>missing something.

Thanks for the response Paul.

MailScanner is indeed blocking the SCR and sending a report about the
attachment. The problem is, this email was a spam message, it's score
was 3.7(bayes 999 only) so it still got through (but with the SCR
stripped).

So I'm looking to add a score on the SCR, adding 1.0. In reality you
could add 20.0 for SCR because I don't ever see a legitimate need to
send these. If I had an extra score to add to the bayes 999 it would not
have gotten through.

Or better yet, how about adding a score on (Filename?) attachment
warning? That would probably be best. Add 1.0 score to any of those.

If anyone know how this can be achieved please let me know. In the past
I've had many of these having to do with Fax, Xerox spam, etc.

Max