Catching attachments.

[Ju...@davenport-industries.com.au]

I'm trying to catch viral attachments, namely those with the extention scr,
exe, bat, com, pif, etc. The Content-Disposition header to catch the
filename.
 
I tried it, using a working RegEx which I verified in a testing program, but
SA doesn't pick it up.
 
Is there an example on how to do this?
 
-Julian Milano
NoSpamToday using SA on WinNT4 using Exchange 5.5
 
PS. Sorry to be vague, but my original post was rejected as spam. Here's
what I got back:
 
Your message was rejected by mail.apache.org for the following reason:

Spam or junk mail threshold exceeded. See
http://www.flame.org/qmail/spamjunk.html (#5.7.1)

The following recipients did not receive this message:

spamassassin-users-info@incubator.apache.org
<ma...@incubator.apache.org> 

Does this happen to anyone else? Imagine! Being flagged as SPAM while trying
to fight it <G>

Re: Catching attachments.

[Bob George <ma...@ttlexceeded.com>]

JulianM@davenport-industries.com.au wrote:

> I'm trying to catch viral attachments, namely those with the extention 
> scr, exe, bat, com, pif, etc. The Content-Disposition header to catch 
> the filename.

What do you mean by "catch"? Filter, quarantine or scan?

SpamAssassin is probably not your best bet (and the Wiki says so!). Yes, 
you can configure rules to detect attachments based on name. No, that's 
not effective as a "good" anti-virus measure.

Better would be to:

1. Use an external tool (i.e. clamav) to do an actual scan based on 
content, rather than just the stated file name.

or

2. Filter/remove/quarantine all incoming attachments. (Just doing this 
based on name is subject to the same limitations.)

There are a couple of other threads going on this same topic that get 
into more specifics of how to do this with other tools.

- Bob

Re: [spa] Catching attachments.

[Charles Gregory <cg...@hwcn.org>]

On Wed, 10 Mar 2004 JulianM@davenport-industries.com.au wrote:
> I'm trying to catch viral attachments, namely those with the extention scr,
> exe, bat, com, pif, etc. The Content-Disposition header to catch the
> filename.
> I tried it, using a working RegEx which I verified in a testing program, but
> SA doesn't pick it up.
> Is there an example on how to do this?

The trick is, only the 'full' rules will check the attachments.
(Unwrap the test line):

full LOC_DBLEXTONATTACH      /name="?[^"]*\.(?:html?|txt|doc|rtf|jpe?g|
gif|wpd|pdf|zip)\.(?:pif|exe|com|cmd|bat|scr)/i

describe LOC_DBLEXTONATTACH  Message attachment has VIRUS-style double ext

score LOC_DBLEXTONATTACH     0.5

Note, this is a minimal test and will also catch messages that give
examples of the double extension IN the body of a message, and trigger on
quoted mime headers with double extensions in bounced mail, etc.

- Charles