On Sun, 2010-07-11 at 17:17 +0200, Benny Pedersen wrote: > On søn 11 jul 2010 17:04:02 CEST, Karsten Bräckelmann wrote > > > Uhm, dude!? I hope that was an accidental address auto-completion. Do > > NOT send spam samples to the list. > > spam?, here clamav see it as virus
Yes, spam. If the included X-Spam headers is anything to go by. But you're free to eyeball the attached messages yourself. No malware payload. Not a virus. One's a phish, though. Let me guess, clamav third-party signatures triggered on the URIs for you? Anyway. The distinction between spam and phish was not my point. Neither was it, whether "spammed URI" clamav third-party signatures match on them just like URIBL and SURBL do. -- char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1: (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}