what's going on here?!?
repeat after me: "spamassassin is no virusscanner!"
virusscanners need to be able to scan attachments, and this is a thing that SA can't do.
have a look here http://www.ijs.si/software/amavisd/
and please stop trying to abuse our spam murdering little ninja, ok? :D
Kai Michael Poppe wrote:
Spam detection software, running on the system "p15139277.pureserver.info", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or block similar future email. If you have any questions, see http://www.cw-mediadesign.de/spaminfo.php for details.
Content analysis details: (5.0 points, 5.0 required)
pts rule name description ---- ---------------------- -------------------------------------------------- 5.0 NORVAG_FILE_ATTACH BODY: Attachment name might be NORVAG virus
------------------------------------------------------------------------
Subject: Re: [SAtalk] Re: [EMAIL PROTECTED] virus From: "Kai Michael Poppe" <[EMAIL PROTECTED]> Date: Wed, 28 Jan 2004 10:46:24 +0100 To: <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Return-Path:
<[EMAIL PROTECTED]>
Received:
from cd9pyeeor5cx45 (wlan-client-010.informatik.uni-bremen.de [134.102.116.11]) by p15139277.pureserver.info (Postfix) with ESMTP id 2F2C2220052 for <[EMAIL PROTECTED]>; Wed, 28 Jan 2004 10:46:31 +0100 (CET)
Message-ID:
<[EMAIL PROTECTED]>
References:
<[EMAIL PROTECTED]>
MIME-Version:
1.0
Content-Type:
text/plain; charset="iso-8859-1"
Content-Transfer-Encoding:
7bit
X-Priority:
3
X-MSMail-Priority:
Normal
X-Mailer:
Microsoft Outlook Express 6.00.2720.3000
X-MimeOLE:
Produced By Microsoft MimeOLE V6.00.2727.1300
Hi List !
I created a ruleset based on bitdefender.de's description on the virus: http://www.poppe-online.de/spamassassin/55_norvag_virus.cf
comments appreciated.
Greetings
Kai M Poppe, [EMAIL PROTECTED]
----- Original Message ----- From: <[EMAIL PROTECTED]>
To: "John Hall" <[EMAIL PROTECTED]>
Cc: <[EMAIL PROTECTED]>
Sent: Tuesday, January 27, 2004 6:11 PM
Subject: Re: [SAtalk] Re: [EMAIL PROTECTED] virus
On Tue, 27 Jan 2004, John Hall wrote:
This is a list of all the filenames I've seen so far today:
body.bat body.exe body.zip data.pif data.scr doc.zip document.pif document.zip kcmnw.exe message.scr message.zip pqoew.pif readme.scr readme.zip text.exe text.zip xatwdu.zip
You can add this:
lyewki.zip
James Smallacombe PlantageNet, Inc. CEO and Janitor [EMAIL PROTECTED] http://3.am =========================================================================
------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
