You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Pat Traynor <pa...@ssih.com> on 2004/11/23 18:58:37 UTC
80K file attachments
Over the past 24 hours or so, I'm getting a LOT of emails of various
types that all have an 80K file attached to it. e.g.:
Return-Path: <ne...@hotmail.com>
Received: from jywwvxqt.com (67.111.167.138.ptr.us.xo.net [67.111.167.138])
by ssih.com (8.11.0/8.11.0) with SMTP id iANGddM15027
for <pa...@ssih.com>; Tue, 23 Nov 2004 11:39:40 -0500
From: new_account@hotmail.com
To: pat@ssih.com
Date: Tue, 23 Nov 2004 15:52:41 UTC
Subject: FwD: Your mail password <KEY:4886>
Importance: Normal
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
Message-ID: <64...@hotmail.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="====5a31217b3c.e1"
Content-Transfer-Encoding: 7bit
X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on ssih.com
X-Spam-Level: ****
X-Spam-Status: No, score=4.1 required=5.0 tests=BAYES_50,DNS_FROM_RFC_POST,
FORGED_HOTMAIL_RCVD2,INVALID_DATE,MISSING_MIMEOLE,NO_REAL_NAME,
PRIORITY_NO_NAME autolearn=no version=3.0.1
Parts/Attachments:
1 Shown 4 lines Text
2 58 KB Application
----------------------------------------
Your password was changed successfully!
++++++ User-Service: http://www.hotmail.com
++++++ MailTo: postmaster@hotmail.com
[ Part 2, Application/OCTET-STREAM (Name: "hotmail.zip") 78KB. ]
[ Cannot display this part. Press "V" then "S" to save in a file.
Some of the files are obvious spam like this, some appear to be messages
that are from system administrators saying that the attached file was
scanned for viruses and none were found, etc. The files are always
named differently.
Is anyone else seeing this, and is there a rule set that I could put
into place to take care of it?
--pat--
--
Pat Traynor
pat@ssih.com
RE: 80K file attachments
Posted by Bret Miller <br...@wcg.org>.
> >> Spam? Virus! :)
> >>
> >> > Is anyone else seeing this, and is there a rule set that
> I could put
> >> > into place to take care of it?
> >>
> >> Your virus scanner should take care of them, most likely its
> >> W32/Sober.J@mm
>
> > Well, my email doesn't get any further than my Linux box,
> so I'm not in
> > any danger of being infected. But I provide email storage
> for others
> > who are using SpamAssassin, and I like to eliminate whatever I can
> > before it gets to them. The virus doesn't bother me. It's
> the emails
> > themselves. As far as I'm concerned, this is spam, and I'd
> like SA to
> > intercept them.
>
> And you *could* use a hammer to drive a screw into wood,
> but a screwdriver works much better and gives better results.
>
> But seriously, use the right tool for the job. Clamav
> works great for us for blocking viruses. SA works
> well for stopping spam.
Yes, and a couple days ago I remember reading about a ClamAV plugin for
SA, so if you really don't want to implement a separate check, check the
archive for info about the plugin.
Bret
Re: 80K file attachments
Posted by Jeff Chan <je...@surbl.org>.
On Tuesday, November 23, 2004, 11:10:19 AM, Pat Traynor wrote:
> On Tue, 23 Nov 2004, Raymond Dijkxhoorn wrote:
>> Spam? Virus! :)
>>
>> > Is anyone else seeing this, and is there a rule set that I could put
>> > into place to take care of it?
>>
>> Your virus scanner should take care of them, most likely its
>> W32/Sober.J@mm
> Well, my email doesn't get any further than my Linux box, so I'm not in
> any danger of being infected. But I provide email storage for others
> who are using SpamAssassin, and I like to eliminate whatever I can
> before it gets to them. The virus doesn't bother me. It's the emails
> themselves. As far as I'm concerned, this is spam, and I'd like SA to
> intercept them.
And you *could* use a hammer to drive a screw into wood,
but a screwdriver works much better and gives better results.
But seriously, use the right tool for the job. Clamav
works great for us for blocking viruses. SA works
well for stopping spam.
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: 80K file attachments
Posted by Troels Walsted Hansen <tr...@thule.no>.
Pat Traynor wrote:
>Well, my email doesn't get any further than my Linux box, so I'm not in
>any danger of being infected. But I provide email storage for others
>who are using SpamAssassin, and I like to eliminate whatever I can
>before it gets to them. The virus doesn't bother me. It's the emails
>themselves. As far as I'm concerned, this is spam, and I'd like SA to
>intercept them.
>
>
http://wiki.apache.org/spamassassin/ClamAVPlugin
</blatant self advertisement> :-)
Troels
Re: 80K file attachments
Posted by Pat Traynor <pa...@ssih.com>.
On Tue, 23 Nov 2004, Raymond Dijkxhoorn wrote:
> Spam? Virus! :)
>
> > Is anyone else seeing this, and is there a rule set that I could put
> > into place to take care of it?
>
> Your virus scanner should take care of them, most likely its
> W32/Sober.J@mm
Well, my email doesn't get any further than my Linux box, so I'm not in
any danger of being infected. But I provide email storage for others
who are using SpamAssassin, and I like to eliminate whatever I can
before it gets to them. The virus doesn't bother me. It's the emails
themselves. As far as I'm concerned, this is spam, and I'd like SA to
intercept them.
--pat--
--
Pat Traynor
pat@ssih.com
Re: 80K file attachments
Posted by Raymond Dijkxhoorn <ra...@prolocation.net>.
Hi!
> Over the past 24 hours or so, I'm getting a LOT of emails of various
> types that all have an 80K file attached to it. e.g.:
> ++++++ User-Service: http://www.hotmail.com
> ++++++ MailTo: postmaster@hotmail.com
> [ Part 2, Application/OCTET-STREAM (Name: "hotmail.zip") 78KB. ]
> [ Cannot display this part. Press "V" then "S" to save in a file.
>
> Some of the files are obvious spam like this, some appear to be messages
> that are from system administrators saying that the attached file was
> scanned for viruses and none were found, etc. The files are always
> named differently.
Spam? Virus! :)
> Is anyone else seeing this, and is there a rule set that I could put
> into place to take care of it?
Your virus scanner should take care of them, most likely its
W32/Sober.J@mm
Bye,
Raymond.
Re: 80K file attachments
Posted by Fred <sp...@freddyt.com>.
Install ClamAV and it'll help you with viruses, SA is a mail filter which
does not do virus checking.