Scott, So Clam AV detects these? We do have Declude AV but, not the PRO version and I think only this version can use multiple AV programs? We use the standard with F-PROT.
Erik -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Sunday, February 19, 2006 8:18 PM To: [email protected] Subject: Re: [Declude.JunkMail] Banks (and Ebay) Phising Filters If you have Declude Virus, and can afford the CPU time... The best phish beater I have is Clam AV and PRESCAN ON. With bank consolodations, the using the reverse dns can be dicey. ----- Original Message ----- From: "Erik" <[EMAIL PROTECTED]> To: <[email protected]> Sent: Friday, February 17, 2006 5:32 PM Subject: [Declude.JunkMail] Banks (and Ebay) Phising Filters > Help from you all: > > We've setup the following individual filters for major banks that are > phising scams (and ebay.com) > > Do you see any problems with using the following (we mark as SPAM at > weight > 70): > > > HEADERS END NOTCONTAINS wellsfargo.com > BODY 0 CONTAINS .wellsfargo.com > SUBJECT 30 CONTAINS account > REVDNS 50 NOTENDSWITH .wellsfargo.com > #Give weight back for users that forward or use reply for REAL email > from wellsfargo.com SUBJECT -40 STARTSWITH re: > SUBJECT -40 STARTSWITH fwd: > SUBJECT -40 STARTSWITH fw: > > > Citibank uses different REVDNS from what we've noticed. > The envelope from is "generally" @citibank.com and the REVDNS is > .ssmb.com OR .citibank.com or .citicorp.com How do you all deal with > this? > > > Same with SearsCard.com... they are also Citibank and coming from > ssmb.com > > --- > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
