Score on attachments

[Alex Neuman]

Sorry, hit wrong key. I was going to say "in any case, the rule is probably
wrong but someone could help correct it".




*Alex Neuman van der Hans*Reliant Technologies / Vida Digital
http://vidadigital.com.pa/

Mobile: +507-6781-9505
Work: +507-832-6725
Work (USA): +1-440-253-9789
Skype: AlexNeuman

Don't miss Vida Digital on LiveStream
<http://new.livestream.com/accounts/5061819>!
Saturdays 8am-10am on 104.3FM Panama

Follow *@AlexNeuman <https://twitter.com/alexneuman>* on Twitter
Like Vida Digital <https://facebook.com/vidadigital/> on Facebook
Follow VidaDigital <http://instagram.com/vidadigital> on Instagram
Subscribe to Vida Digital <https://youtube.com/reliantpty> on Youtube


On Fri, Jun 27, 2014 at 12:57 PM, Alex Neuman <alex at vidadigital.com.pa>
wrote:

> What about not allowing messages with forbidden attachments through at
> all?
>
> In any case, you might want to try something like this:
>
> mimeheader SCR_ATTACHED Content-Type =~ /scr/i
> describe SCR_ATTACHED email contains an scr file attachment
> score SCR_ATTACHED 1.0
> In
>
>
>
>
> *Alex Neuman van der Hans*Reliant Technologies / Vida Digital
> http://vidadigital.com.pa/
>
> Mobile: +507-6781-9505
> Work: +507-832-6725
> Work (USA): +1-440-253-9789
> Skype: AlexNeuman
>
> Don't miss Vida Digital on LiveStream
> <http://new.livestream.com/accounts/5061819>!
> Saturdays 8am-10am on 104.3FM Panama
>
> Follow *@AlexNeuman <https://twitter.com/alexneuman>* on Twitter
> Like Vida Digital <https://facebook.com/vidadigital/> on Facebook
> Follow VidaDigital <http://instagram.com/vidadigital> on Instagram
> Subscribe to Vida Digital <https://youtube.com/reliantpty> on Youtube
>
>
> On Fri, Jun 27, 2014 at 11:27 AM, Max Kipness <max at inmindlabs.com> wrote:
>
>> >>* Max Kipness <max at inmindlabs.com> [2014-06-27 11:15]:
>> >> I sometimes get spam with attachments that are usually SCR files. For
>> >> example just a few minutes ago I received about 401k fund
>> >> participants/performance. Everything on my MailScanner system is
>> setup
>> >> correctly. I'm using Bayes (manual), Razor, Pyzor, DCC, custom rules,
>> >> you name it. So this message received a Bayes 999, which is correct.
>> But
>> >> nothing else was triggered. I'm looking at some type of custom rule,
>> but
>> >> I sure would be nice if we could score on an attachment present in
>> >> general, or certain extensions like an SCR. Or if we could score on
>> the
>> >> fact that the message was caught by MailScanner with an attachment
>> >> warning.
>>
>> >It's been awhile since I looked at this, but I was under the impression
>> >that this was covered by normal, uncustomized, rules:
>> >
>> >1) MailScanner.conf has
>> >
>> >   Filename Rules = %etc-dir%/filename.rules.conf
>> >
>> >2) filename.rules.conf has
>> >
>> >    deny    \.scr$     Possible virus hidden in a screensaver  Windows
>> Screensavers are often used to hide viruses
>> >
>> >But you say that everything is set up correctly, so I'm almost
>> certainly
>> >missing something.
>>
>> Thanks for the response Paul.
>>
>> MailScanner is indeed blocking the SCR and sending a report about the
>> attachment. The problem is, this email was a spam message, it's score
>> was 3.7(bayes 999 only) so it still got through (but with the SCR
>> stripped).
>>
>> So I'm looking to add a score on the SCR, adding 1.0. In reality you
>> could add 20.0 for SCR because I don't ever see a legitimate need to
>> send these. If I had an extra score to add to the bayes 999 it would not
>> have gotten through.
>>
>> Or better yet, how about adding a score on (Filename?) attachment
>> warning? That would probably be best. Add 1.0 score to any of those.
>>
>> If anyone know how this can be achieved please let me know. In the past
>> I've had many of these having to do with Fax, Xerox spam, etc.
>>
>> Max
>> --
>> MailScanner mailing list
>> mailscanner at lists.mailscanner.info
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>> Before posting, read http://wiki.mailscanner.info/posting
>>
>> Support MailScanner development - buy the book off the website!
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20140627/9322ba85/attachment.html