<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:p="urn:schemas-microsoft-com:office:powerpoint" xmlns:a="urn:schemas-microsoft-com:office:access" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs="urn:schemas-microsoft-com:rowset" xmlns:z="#RowsetSchema" xmlns:b="urn:schemas-microsoft-com:office:publisher" xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet" xmlns:c="urn:schemas-microsoft-com:office:component:spreadsheet" xmlns:odc="urn:schemas-microsoft-com:office:odc" xmlns:oa="urn:schemas-microsoft-com:office:activation" xmlns:html="http://www.w3.org/TR/REC-html40" xmlns:q="http://schemas.xmlsoap.org/soap/envelope/" xmlns:rtc="http://microsoft.com/officenet/conferencing" xmlns:D="DAV:" xmlns:Repl="http://schemas.microsoft.com/repl/" xmlns:mt="http://schemas.microsoft.com/sharepoint/soap/meetings/" xmlns:x2="http://schemas.microsoft.com/office/excel/2003/xml" xmlns:ppda="http://www.passport.com/NameSpace.xsd" xmlns:ois="http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir="http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:dsp="http://schemas.microsoft.com/sharepoint/dsp" xmlns:udc="http://schemas.microsoft.com/data/udc" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:sub="http://schemas.microsoft.com/sharepoint/soap/2002/1/alerts/" xmlns:ec="http://www.w3.org/2001/04/xmlenc#" xmlns:sp="http://schemas.microsoft.com/sharepoint/" xmlns:sps="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:udcs="http://schemas.microsoft.com/data/udc/soap" xmlns:udcxf="http://schemas.microsoft.com/data/udc/xmlfile" xmlns:udcp2p="http://schemas.microsoft.com/data/udc/parttopart" xmlns:wf="http://schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:dsss="http://schemas.microsoft.com/office/2006/digsig-setup" xmlns:dssi="http://schemas.microsoft.com/office/2006/digsig" xmlns:mdssi="http://schemas.openxmlformats.org/package/2006/digital-signature" xmlns:mver="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mrels="http://schemas.openxmlformats.org/package/2006/relationships" xmlns:spwp="http://microsoft.com/sharepoint/webpartpages" xmlns:ex12t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:ex12m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:pptsl="http://schemas.microsoft.com/sharepoint/soap/SlideLibrary/" xmlns:spsl="http://microsoft.com/webservices/SharePointPortalServer/PublishedLinksService" xmlns:Z="urn:schemas-microsoft-com:" xmlns:st="" xmlns="http://www.w3.org/TR/REC-html40"
xmlns:ns0="urn:schemas-microsoft-com:office:smarttags">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-GB link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Hi Martin,<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Thanks for this, sorry if I’m being stupid, but I’m
using freebsd and I’ve updated my port tree, however I don’t see
the latest version in there – <o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>less distinfo<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>MD5 (MailScanner-install-4.60.5-1.tar.gz) =
cf1e87131f90ff7f43e1f4c1d787a245<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>SHA256 (MailScanner-install-4.60.5-1.tar.gz) =
1ec3fd536e05f5da0b1551cc57664bb4379e049e8243e0ed112e33325c53b994<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>SIZE (MailScanner-install-4.60.5-1.tar.gz) = 7704758<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Can this be updated?<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Rich<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'>
<p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:
"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;
font-family:"Tahoma","sans-serif"'> mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] <b>On Behalf Of </b>Martin
Hepworth<br>
<b>Sent:</b> 27 August 2009 09:20<br>
<b>To:</b> MailScanner discussion<br>
<b>Subject:</b> Re: image spam again :)<o:p></o:p></span></p>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal style='margin-bottom:12.0pt'>Richard<br>
<br>
from changelog in latest beta.<o:p></o:p></p>
<pre>3 Swapped over virus-scanning and spam-scanning code completely, so all<br>
virus-scanning code is done before spam-scanning code. It won't virus-<br>
scan "Silent Viruses" which is pretty much all of them now, so it should<br>
<br>
<o:p></o:p></pre><pre> work okay. This allows me to introduce...<br>
3 New feature to allow detection of "spam-viruses" which are items of spam<br>
that are reported by your virus scanner. You can set 2 new configuration<br>
options:<br>
<br>
<o:p></o:p></pre><pre> Spam-Virus Header = X-%org-name%-MailScanner-SpamVirus-Report:<br>
Virus Names Which Are Spam = Sane*UNOFFICIAL HTML/*<br>
The names of the "spam-viruses" found are those viruses reported by your<br>
virus scanners which match any of the strings given in "Virus Names Which<br>
<br>
<o:p></o:p></pre><pre> Are Spam". These "spam-virus" names are added to the header set by<br>
"Spam-Virus Header". You can then write a SpamAssassin rule in<br>
spam.assassin.prefs.conf which gives a score for the presence or contents<br>
<br>
<o:p></o:p></pre><pre> of this header. I supply an example rule which adds a score of 3 if the<br>
header exists. Feel free to re-write and extend that rule! It will not work<br>
unless you customise it. You could even write a "SpamAssassin Rule Action"<br>
<br>
<o:p></o:p></pre><pre> to handle this rule specially!<o:p></o:p></pre>
<p class=MsoNormal style='margin-bottom:12.0pt'>I think does want you want.<br
clear=all>
<br>
-- <br>
Martin Hepworth<br>
Oxford, UK<o:p></o:p></p>
<div>
<p class=MsoNormal>2009/8/27 Richard Mealing <<a
href="mailto:richard@fastnet.co.uk">richard@fastnet.co.uk</a>><o:p></o:p></p>
<p class=MsoNormal>Hi Michael,<br>
<br>
I am using that sanesecurity and it's great (thanks for the heads up), however
I was wondering if there is a way to forward on the spam mail to the recipient,
like spamassassins mail it goes off as per the ruleset, but because this is
clamav catching the spam it gets quarantined.<br>
<br>
Any thoughts?<br>
<br>
Many thanks,<br>
Rich<o:p></o:p></p>
<div>
<p class=MsoNormal><br>
-----Original Message-----<br>
From: <a href="mailto:mailscanner-bounces@lists.mailscanner.info">mailscanner-bounces@lists.mailscanner.info</a>
[mailto:<a href="mailto:mailscanner-bounces@lists.mailscanner.info">mailscanner-bounces@lists.mailscanner.info</a>]
On Behalf Of Michael Mansour<o:p></o:p></p>
</div>
<div>
<div>
<p class=MsoNormal style='margin-bottom:12.0pt'>Sent: 25 August 2009 09:04<br>
To: MailScanner discussion<br>
Subject: RE: image spam again :)<br>
<br>
Hi Jonas,<br>
<br>
> From: Jonas A. Larsen <<a href="mailto:jonas@vrt.dk">jonas@vrt.dk</a>><br>
> Subject: RE: image spam again :)<br>
> To: "'MailScanner discussion'" <<a
href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a>><br>
> Received: Tuesday, 25 August, 2009, 4:18 PM<br>
> > > we are seeing a lot of<br>
> image spam again. we are running sa update and<br>
> > > the image tings they publish / <a href="http://imageinfo.cf"
target="_blank">imageinfo.cf</a> and<br>
> others. But lately a lot<br>
> > > is getting through.<br>
> > ><br>
> ><br>
> > I hadn't noticed... use <a href="http://zen.spamhaus.org"
target="_blank">zen.spamhaus.org</a> and<br>
> <a href="http://bl.spamcop.net" target="_blank">bl.spamcop.net</a> at SMTP
time<br>
> > along with 15 mins of greylisting for unknown<br>
> hosts. Problem solved.<br>
> ><br>
> > Regards,<br>
> > Steve.<br>
><br>
> Mmmm well let's be frank Steve, that’s just simply<br>
> entirely untrue :)<br>
><br>
> The past weeks have seen a rise in image based spam, where<br>
> many of them (the<br>
> ones that doesn’t hit obvious rbl's etc) slip by even ocr<br>
> plugins etc.<br>
><br>
> If you take a look at the SA list you can see lots of<br>
> people are seeing this<br>
> new bunch of image spams and pretty penetrating.<br>
><br>
> So far there's no sure fire way of stopping it if you are<br>
> to judge by the sa<br>
> users responses.<br>
><br>
> I use spamhaus and spamcop in mta and greylist, and I've<br>
> gotten a few of<br>
> them myself.<br>
><br>
> Many of them use the so called "flag" method where the<br>
> image looks "wavy"<br>
> like a flag, which is probably whats disabling the ocr<br>
> techniques.<br>
><br>
> If anybody got any advice I'd love to hear it.<br>
<br>
>From my end, I haven't noticed any image spam getting through. But, I use
SaneSecurity clam signatures which import the MSRBL image spam definitions, so
maybe that is why?<br>
<br>
I don't have time to go through the virus infected emails, but I'd suggest if
you don't use SaneSecurity signatures in ClamAV, you should.<br>
<br>
Regards,<br>
<br>
Michael.<br>
<br>
<br>
<br>
__________________________________________________________________________________<br>
Find local businesses and services in your area with Yahoo!7 Local.<br>
Get started: <a href="http://local.yahoo.com.au" target="_blank">http://local.yahoo.com.au</a><br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner"
target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting"
target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
<br>
<o:p></o:p></p>
</div>
</div>
<p class=MsoNormal style='margin-bottom:12.0pt'><br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner"
target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting"
target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<o:p></o:p></p>
</div>
<p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p>
</div>
</body>
</html>