New virus difficoutl to catch

Questions and answers about how to do stuff
Post Reply
nicola.piazzi
Posts: 218
Joined: 23 Apr 2015 09:45

New virus difficoutl to catch

Post by nicola.piazzi » 10 Jul 2018 09:50

There is a virus that make a reply to all inbox messages and send mail attaching itself
It is very difficoult to catch because il is a reply to a valid mail
Have someone some idea of a rule to catch it ?

i found that it is positive to FORGED_MUA_OUTLOOK at now

Someone know how to remove attachements when a message is positive to a single rule ?

User avatar
shawniverson
Posts: 2559
Joined: 13 Jan 2014 23:30
Location: Rushville, Indiana, USA
Contact:

Re: New virus difficoutl to catch

Post by shawniverson » 11 Jul 2018 09:56

Can you identify the attachment somehow in MailScanner?

SpamAssassin won't remove attachments. I'm not sure there is some way to inform MailScanner to remove the attachment via SA....
Version 3.0.2.6 released! Update now to keep your eFa secure!

nicola.piazzi
Posts: 218
Joined: 23 Apr 2015 09:45

Re: New virus difficoutl to catch

Post by nicola.piazzi » 11 Jul 2018 10:04

attachment name changes each time, i think that there is no way
the only way can be to remove attachments in high score spam (and can be useful)

User avatar
shawniverson
Posts: 2559
Joined: 13 Jan 2014 23:30
Location: Rushville, Indiana, USA
Contact:

Re: New virus difficoutl to catch

Post by shawniverson » 12 Jul 2018 21:14

Are the content similar? You could identify it using a custom signature perhaps?
Version 3.0.2.6 released! Update now to keep your eFa secure!

Post Reply