Re: Rule for PDF and eCard Spam Needed

On Tue, Aug 14, 2007 at 07:53:56PM -0700, Robert - elists wrote:
>
> > Apparently with alternate virus files, which I had not yet tested.
> > Someone mentioned that earlier today and I'm investigating it.
> >
> > --
> > Jo Rhett
>
> Jo
>
> I don't use alternative files that I am aware of anyways... just stock
> clamav
>

Me too....

I am only a home user, but I have found that bog-standard clamAV (updated with freshclam) has caught all but one of the greeting card scams:

	Subject: You've received a postcard from a Colleague!
	X-Virus-Status: Yes
	X-Virus-Report: Email.Phishing.RB-1223 FOUND 
	X-Virus-Checker-Version: clamassassin 1.2.4 with clamscan / ClamAV 0.91.1/3848/Thu Aug  2 21:22:06 2007

I use clamav via procmail *before* SA and any positives identified by clamav get whisked off into a quarantine folder so I don't know whether SA would have caught them or not.

...just my £0.02...

Best Regards

AD