No, definitely not a virus... the HTML attachments definitely contain spam (18 year olds, get out of debt, and such). I'm running ClamAV on the spamassassin box and Symantec AV on the exchange server and everythings up to date. I'm running quite a few of the SARE rules, but not much is getting tagged. One of the 3 I got last night hit the following:
Mar 30 03:38:43 Spamcatcher amavis[9570]: (09570-07) spam_scan: hits=2.648 tests=BAYES_50,HTML_MESSAGE,PRIORITY_NO_NAME,RATWR7a_MESSID,RM_rb_BODY,R M_rb_HTML,TO_ADDRESS_EQ_REAL I've been feeding them as spam via sa-learn but it doesn't seem to have any effect. Thanks, -- Shawn Beairsto Network Administrator Data Kinetics Ltd. -----Original Message----- From: Bob George [mailto:[EMAIL PROTECTED] Sent: Tuesday, March 30, 2004 9:34 AM To: [EMAIL PROTECTED] Subject: Re: New type of spam Shawn R. Beairsto wrote: > [...] > I've been getting a fair number of spams the last week or so getting > past spamassassin (2.63). They typically have a nonsense subject line, > and something in the body like "This message has an attachment that will > make you happy" This sounds like a lot of the virus/trojans going around. > There is an HTML attachment included, which contains the actual spam > message. They are scoring anywhere between 1.5 and 2.6. Does anyone have > a rule to catch these? Spam or virus? Can you put up a sample somewhere (without posting a virus to the list?) - Bob
