Re: Word macros

2015-12-22 Thread Sebastian Arcus
On 22/12/15 10:07, Reindl Harald wrote: Am 22.12.2015 um 10:26 schrieb Sebastian Arcus: In terms of ClamAV, I've had next to zero hit rates for new viruses arriving over email in the last few months (although it is being updated regularly) - so I'm starting to wonder if there is any point in u

Re: Word macros

2015-12-22 Thread Alex
Hi, >>> http://pastebin.com/cAWcAbm2 >>> >>> This one still isn't tagged by clamav/sanesecurity. I've submitted >>> this sample, so perhaps it is now, but I thought someone might have >>> some ideas for a meta or something else in the message that could more >>> generally tag these? >>> >>> Anyone

Re: Word macros

2015-12-22 Thread Benny Pedersen
On December 22, 2015 10:26:31 AM Sebastian Arcus wrote: http://pastebin.com/cAWcAbm2 In terms of ClamAV, I've had next to zero hit rates for new viruses arriving over email in the last few months (although it is being updated regularly) - so I'm starting to wonder if there is any point in us

Re: Word macros

2015-12-22 Thread Reindl Harald
Am 22.12.2015 um 10:26 schrieb Sebastian Arcus: In terms of ClamAV, I've had next to zero hit rates for new viruses arriving over email in the last few months (although it is being updated regularly) - so I'm starting to wonder if there is any point in using ClamAV for scanning emails at all

Re: Word macros

2015-12-22 Thread Sebastian Arcus
On 22/12/15 08:04, Axb wrote: On 12/21/2015 11:46 PM, Alex wrote: Hi all, For the past few days we've been hit with Word macro viruses/spam that isn't being tagged by clamav or spamassassin, and I thought someone might be able to take a look: http://pastebin.com/cAWcAbm2 This one still isn't

Re: Word macros

2015-12-22 Thread Axb
On 12/21/2015 11:46 PM, Alex wrote: Hi all, For the past few days we've been hit with Word macro viruses/spam that isn't being tagged by clamav or spamassassin, and I thought someone might be able to take a look: http://pastebin.com/cAWcAbm2 This one still isn't tagged by clamav/sanesecurity.

Re: Word macros

2015-12-21 Thread Dianne Skoll
On Mon, 21 Dec 2015 21:02:21 -0500 Alex wrote: > Is mimedefang the de facto method for blocking Word macro files? I > haven't ever implemented it. Can it work with postfix/amavis? I don't know about de-facto, but it's what I use... hence my posting. If Amavis lets you write snippets of Perl cod

Re: Word macros

2015-12-21 Thread Alex
Hi, On Mon, Dec 21, 2015 at 6:14 PM, Kevin A. McGrail wrote: > On 12/21/2015 5:46 PM, Alex wrote: >> >> For the past few days we've been hit with Word macro viruses/spam that >> isn't being tagged by clamav or spamassassin, and I thought someone >> might be able to take a look: >> >> http://paste

Re: Word macros

2015-12-21 Thread Kevin A. McGrail
On 12/21/2015 5:46 PM, Alex wrote: For the past few days we've been hit with Word macro viruses/spam that isn't being tagged by clamav or spamassassin, and I thought someone might be able to take a look: http://pastebin.com/cAWcAbm2 This one still isn't tagged by clamav/sanesecurity. I've submi

Word macros

2015-12-21 Thread Alex
Hi all, For the past few days we've been hit with Word macro viruses/spam that isn't being tagged by clamav or spamassassin, and I thought someone might be able to take a look: http://pastebin.com/cAWcAbm2 This one still isn't tagged by clamav/sanesecurity. I've submitted this sample, so perhaps