Score on attachments

[Alex Neuman]

It may be possible that he's skipping scanning on certain users out of
convenience, but opening the door to trojans in the process.



*Alex Neuman van der Hans*Reliant Technologies / Vida Digital
http://vidadigital.com.pa/

Mobile: +507-6781-9505
Work: +507-832-6725
Work (USA): +1-440-253-9789
Skype: AlexNeuman

Don't miss Vida Digital on LiveStream
<http://new.livestream.com/accounts/5061819>!
Saturdays 8am-10am on 104.3FM Panama

Follow *@AlexNeuman <https://twitter.com/alexneuman>* on Twitter
Like Vida Digital <https://facebook.com/vidadigital/> on Facebook
Follow VidaDigital <http://instagram.com/vidadigital> on Instagram
Subscribe to Vida Digital <https://youtube.com/reliantpty> on Youtube


On Fri, Jun 27, 2014 at 10:35 AM, Paul A Sand <pas at unh.edu> wrote:

> * Max Kipness <max at inmindlabs.com> [2014-06-27 11:15]:
> > I sometimes get spam with attachments that are usually SCR files. For
> > example just a few minutes ago I received about 401k fund
> > participants/performance. Everything on my MailScanner system is setup
> > correctly. I'm using Bayes (manual), Razor, Pyzor, DCC, custom rules,
> > you name it. So this message received a Bayes 999, which is correct. But
> > nothing else was triggered. I'm looking at some type of custom rule, but
> > I sure would be nice if we could score on an attachment present in
> > general, or certain extensions like an SCR. Or if we could score on the
> > fact that the message was caught by MailScanner with an attachment
> > warning.
>
> It’s been awhile since I looked at this, but I was under the impression
> that this was covered by normal, uncustomized, rules:
>
> 1) MailScanner.conf has
>
>     Filename Rules = %etc-dir%/filename.rules.conf
>
> 2) filename.rules.conf has
>
>     deny    \.scr$      Possible virus hidden in a screensaver  Windows
> Screensavers are often used to hide viruses
>
> But you say that everything is set up correctly, so I’m almost certainly
> missing something.
>
> --
> -- Paul A Sand <pas at unh.edu>
> -- Information Technology / University of New Hampshire
> -- http://pubpages.unh.edu/~pas
> -- No electrons were harmed in the transmission of this message.
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20140627/9d92e77b/attachment.html