<div dir="ltr">What about not allowing messages with forbidden attachments through at all? <br><br><div>In any case, you might want to try something like this:<br><br></div><div><p style="margin:1em 0px;padding:0px 0px 0px 30px">
<font color="#000000" face="Courier New, Courier, mono">mimeheader SCR_ATTACHED Content-Type =~ /scr/i</font><br><font color="#000000" face="Courier New, Courier, mono">describe SCR_ATTACHED email contains an scr file attachment</font><br>
<font color="#000000" face="Courier New, Courier, mono">score SCR_ATTACHED 1.0</font><font color="#000000" face="Courier New, Courier, mono"><br></font>In </p></div><div><br></div><img src="http://t.sigopn01.com/img.gif?ukey=agxzfnNpZ25hbHNjcnhyGAsSC1VzZXJQcm9maWxlGICAgKCUyroKDA&key=b8308b61-32ce-416d-818a-bb96dcb229e1" width="1" height="1" style="display:none"></div>
<div class="gmail_extra"><br clear="all"><div><div dir="ltr"><div style="font-family:arial;font-size:small"><div><br><b>Alex Neuman van der Hans<br></b>Reliant Technologies / Vida Digital<br><a href="http://vidadigital.com.pa/" style="color:rgb(17,85,204)" target="_blank">http://vidadigital.com.pa/</a><br>
<br></div><div>Mobile: +507-6781-9505<br>Work: +507-832-6725<br>Work (USA): +1-440-253-9789</div><div>Skype: <a>AlexNeuman</a></div><div><br>Don't miss <a href="http://new.livestream.com/accounts/5061819" target="_blank">Vida Digital on LiveStream</a>!</div>
<div>Saturdays 8am-10am on 104.3FM Panama</div><div><br>Follow <b><a href="https://twitter.com/alexneuman" style="color:rgb(17,85,204)" target="_blank">@AlexNeuman</a></b> on Twitter<br>Like <a href="https://facebook.com/vidadigital/" style="color:rgb(17,85,204)" target="_blank">Vida Digital</a> on Facebook</div>
</div><div style="font-family:arial;font-size:small">Follow <a href="http://instagram.com/vidadigital" style="color:rgb(17,85,204)" target="_blank">VidaDigital</a> on Instagram</div><div style="font-family:arial;font-size:small">
Subscribe to <a href="https://youtube.com/reliantpty" style="color:rgb(17,85,204)" target="_blank">Vida Digital</a> on Youtube</div></div></div>
<br><br><div class="gmail_quote">On Fri, Jun 27, 2014 at 11:27 AM, Max Kipness <span dir="ltr"><<a href="mailto:max@inmindlabs.com" target="_blank">max@inmindlabs.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
>>* Max Kipness <max at <a href="http://inmindlabs.com" target="_blank">inmindlabs.com</a>> [2014-06-27 11:15]:<br>
>> I sometimes get spam with attachments that are usually SCR files. For<br>
>> example just a few minutes ago I received about 401k fund<br>
>> participants/performance. Everything on my MailScanner system is<br>
setup<br>
>> correctly. I'm using Bayes (manual), Razor, Pyzor, DCC, custom rules,<br>
>> you name it. So this message received a Bayes 999, which is correct.<br>
But<br>
>> nothing else was triggered. I'm looking at some type of custom rule,<br>
but<br>
>> I sure would be nice if we could score on an attachment present in<br>
>> general, or certain extensions like an SCR. Or if we could score on<br>
the<br>
>> fact that the message was caught by MailScanner with an attachment<br>
>> warning.<br>
<br>
>It's been awhile since I looked at this, but I was under the impression<br>
>that this was covered by normal, uncustomized, rules:<br>
><br>
>1) MailScanner.conf has<br>
><br>
> Filename Rules = %etc-dir%/filename.rules.conf<br>
><br>
>2) filename.rules.conf has<br>
><br>
> deny \.scr$ Possible virus hidden in a screensaver Windows<br>
Screensavers are often used to hide viruses<br>
><br>
>But you say that everything is set up correctly, so I'm almost<br>
certainly<br>
>missing something.<br>
<br>
Thanks for the response Paul.<br>
<br>
MailScanner is indeed blocking the SCR and sending a report about the<br>
attachment. The problem is, this email was a spam message, it's score<br>
was 3.7(bayes 999 only) so it still got through (but with the SCR<br>
stripped).<br>
<br>
So I'm looking to add a score on the SCR, adding 1.0. In reality you<br>
could add 20.0 for SCR because I don't ever see a legitimate need to<br>
send these. If I had an extra score to add to the bayes 999 it would not<br>
have gotten through.<br>
<br>
Or better yet, how about adding a score on (Filename?) attachment<br>
warning? That would probably be best. Add 1.0 score to any of those.<br>
<br>
If anyone know how this can be achieved please let me know. In the past<br>
I've had many of these having to do with Fax, Xerox spam, etc.<br>
<span class="HOEnZb"><font color="#888888"><br>
Max<br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
</font></span></blockquote></div><br></div>