<div dir="ltr">It may be possible that he's skipping scanning on certain users out of convenience, but opening the door to trojans in the process. <img src="http://t.sigopn01.com/img.gif?ukey=agxzfnNpZ25hbHNjcnhyGAsSC1VzZXJQcm9maWxlGICAgKCUyroKDA&key=df6f8090-83ea-4aba-d439-eba761828f37" width="1" height="1" style="display:none"></div>
<div class="gmail_extra"><br clear="all"><div><div dir="ltr"><div style="font-family:arial;font-size:small"><div><br><b>Alex Neuman van der Hans<br></b>Reliant Technologies / Vida Digital<br><a href="http://vidadigital.com.pa/" style="color:rgb(17,85,204)" target="_blank">http://vidadigital.com.pa/</a><br>
<br></div><div>Mobile: +507-6781-9505<br>Work: +507-832-6725<br>Work (USA): +1-440-253-9789</div><div>Skype: <a>AlexNeuman</a></div><div><br>Don't miss <a href="http://new.livestream.com/accounts/5061819" target="_blank">Vida Digital on LiveStream</a>!</div>
<div>Saturdays 8am-10am on 104.3FM Panama</div><div><br>Follow <b><a href="https://twitter.com/alexneuman" style="color:rgb(17,85,204)" target="_blank">@AlexNeuman</a></b> on Twitter<br>Like <a href="https://facebook.com/vidadigital/" style="color:rgb(17,85,204)" target="_blank">Vida Digital</a> on Facebook</div>
</div><div style="font-family:arial;font-size:small">Follow <a href="http://instagram.com/vidadigital" style="color:rgb(17,85,204)" target="_blank">VidaDigital</a> on Instagram</div><div style="font-family:arial;font-size:small">
Subscribe to <a href="https://youtube.com/reliantpty" style="color:rgb(17,85,204)" target="_blank">Vida Digital</a> on Youtube</div></div></div>
<br><br><div class="gmail_quote">On Fri, Jun 27, 2014 at 10:35 AM, Paul A Sand <span dir="ltr"><<a href="mailto:pas@unh.edu" target="_blank">pas@unh.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
* Max Kipness <<a href="mailto:max@inmindlabs.com">max@inmindlabs.com</a>> [2014-06-27 11:15]:<br>
> I sometimes get spam with attachments that are usually SCR files. For<br>
> example just a few minutes ago I received about 401k fund<br>
> participants/performance. Everything on my MailScanner system is setup<br>
> correctly. I'm using Bayes (manual), Razor, Pyzor, DCC, custom rules,<br>
> you name it. So this message received a Bayes 999, which is correct. But<br>
> nothing else was triggered. I'm looking at some type of custom rule, but<br>
> I sure would be nice if we could score on an attachment present in<br>
> general, or certain extensions like an SCR. Or if we could score on the<br>
> fact that the message was caught by MailScanner with an attachment<br>
> warning.<br>
<br>
It’s been awhile since I looked at this, but I was under the impression<br>
that this was covered by normal, uncustomized, rules:<br>
<br>
1) MailScanner.conf has<br>
<br>
Filename Rules = %etc-dir%/filename.rules.conf<br>
<br>
2) filename.rules.conf has<br>
<br>
deny \.scr$ Possible virus hidden in a screensaver Windows Screensavers are often used to hide viruses<br>
<br>
But you say that everything is set up correctly, so I’m almost certainly<br>
missing something.<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
-- Paul A Sand <<a href="mailto:pas@unh.edu">pas@unh.edu</a>><br>
-- Information Technology / University of New Hampshire<br>
-- <a href="http://pubpages.unh.edu/~pas" target="_blank">http://pubpages.unh.edu/~pas</a><br>
-- No electrons were harmed in the transmission of this message.<br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
</font></span></blockquote></div><br></div>