New virus difficoutl to catch

Questions and answers about how to do stuff
Post Reply
nicola.piazzi
Posts: 388
Joined: 23 Apr 2015 09:45

New virus difficoutl to catch

Post by nicola.piazzi »

There is a virus that make a reply to all inbox messages and send mail attaching itself
It is very difficoult to catch because il is a reply to a valid mail
Have someone some idea of a rule to catch it ?

i found that it is positive to FORGED_MUA_OUTLOOK at now

Someone know how to remove attachements when a message is positive to a single rule ?
User avatar
shawniverson
Posts: 3644
Joined: 13 Jan 2014 23:30
Location: Indianapolis, Indiana USA
Contact:

Re: New virus difficoutl to catch

Post by shawniverson »

Can you identify the attachment somehow in MailScanner?

SpamAssassin won't remove attachments. I'm not sure there is some way to inform MailScanner to remove the attachment via SA....
nicola.piazzi
Posts: 388
Joined: 23 Apr 2015 09:45

Re: New virus difficoutl to catch

Post by nicola.piazzi »

attachment name changes each time, i think that there is no way
the only way can be to remove attachments in high score spam (and can be useful)
User avatar
shawniverson
Posts: 3644
Joined: 13 Jan 2014 23:30
Location: Indianapolis, Indiana USA
Contact:

Re: New virus difficoutl to catch

Post by shawniverson »

Are the content similar? You could identify it using a custom signature perhaps?
Post Reply