-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Robert Schetterer schrieb: > Matus UHLAR - fantomas schrieb: >>> Hendrik Helmvoigt wrote: >>>> This night it seems like we're beeing spammed again by xml documents, >>>> but this time neatly packed into a zipfile: >>>> >>>> I'm really excited whats going to happen next. Maybe psd files embedded >>>> in pdf and then rar'ed. >>>> >>>> And i'd still like to meet the person that goes through all that trouble >>>> to read that spam, and then performs the action that the spammer wants >>> >from him. >> On 22.07.07 18:47, John Rudd wrote: >>> As I've said for years: we should just ban attachments. They're not >>> really useful for anything that can't be done a better way. Which only >>> leaves them being useful for attacks of one form or another. >> some people just want, some just need attachments. I think that if a filter >> (word plugin is used with different meaning in SA) would preprocess/convert >> those attachments to text, SA could just run standard rules over it and >> catch unwelcome words, do BAYES check over it, etc etc. > >> So the words "dear winner" would match no matter if stored in text, HTML, >> .doc (tnef), gif or pdf ... > >> Is there any such plan for SA? > Hi all, > meanwhile > http://sanesecurity.co.uk/clamav/ > catches also these zip spam
i forgot read the story here http://sanesecurity.blogspot.com/2007/07/from-pdf-to-xls-to-zipped-xls-stock.html and thx to steve for its work - -- Mit freundlichen Gruessen Best Regards Robert Schetterer https://www.schetterer.org Germany -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org iD8DBQFGpHGXfGH2AvR16oERAtV7AJ4+brYiSRH6Vw2lPVhJyKQ5tmUhlgCfWk77 QiSPZGpUdTKEWesgbfVh7So= =W6Xw -----END PGP SIGNATURE-----
