Micosoft hoax emails

Jamison wrote:

> Hi
>
> I'm running Qmail on E-smith 5.6 Server and I get flooded with about 50
> per day of these emails.
>
> Eg- 'Security Update' 'Bug Report' 'Microsoft Corporation' etc etc.
>
> I've installed spam assassin, but it doesn't seem to detect these as spam.
>
> Any Ideas?
>
> Jamie
Youre in someones Address Book. This someone has a virus!

Take a look at symantec.com
--
Mit freundlichen Grueßen,
Sascha Thomas Spreitzer
http://sascha.sspreitzer.net

Hi

I'm running Qmail on E-smith 5.6 Server and I get flooded with about 50 per
day of these emails.

Eg- 'Security Update' 'Bug Report' 'Microsoft Corporation' etc etc.

I've installed spam assassin, but it doesn't seem to detect these as spam.

Any Ideas?

Jamie

> I'm running Qmail on E-smith 5.6 Server and I get flooded with about
> 50 per day of these emails.
>
> Eg- 'Security Update' 'Bug Report' 'Microsoft Corporation' etc etc.
>
> I've installed spam assassin, but it doesn't seem to detect these as
> spam.

It's a virus. Use a filter designed to get rid of such mail carrying
dangerous attachments. For example:
http://www.pc-tools.net/unix/renattach/

--
Jem Berkes
http://www.sysdesign.ca/

Jamison wrote:
> Hi
>
> I'm running Qmail on E-smith 5.6 Server and I get flooded with about 50 per
> day of these emails.
>
> Eg- 'Security Update' 'Bug Report' 'Microsoft Corporation' etc etc.
>
> I've installed spam assassin, but it doesn't seem to detect these as spam.
>
> Any Ideas?
>
> Jamie
>
>
Add a spam assassin rule to filter out messages that say
"Run attached file." in the body and assign them 5 points.
This doesn't work for the other worm thats going around the one
that says its an undelivered mail.

Ivor Cave

On Sat, 22 Nov 2003 09:37:57 +0000, Ivor Cave wrote:

> Jamison wrote:
>> Hi
>>
>> I'm running Qmail on E-smith 5.6 Server and I get flooded with about 50 per
>> day of these emails.
>>
>> Eg- 'Security Update' 'Bug Report' 'Microsoft Corporation' etc etc.
>>
>> I've installed spam assassin, but it doesn't seem to detect these as spam.
>>
>> Any Ideas?
>>

This worked fine for me - add it to your system-wide SpamAssassin conf
file or the local one as appropriate, and tweak the scoring to suit:
score MICROSOFT_EXECUTABLE 10.0

B.
--
Slippery when wet.

Brian wrote:
> On Sat, 22 Nov 2003 09:37:57 +0000, Ivor Cave wrote:
>>Jamison wrote:
>>>Hi
>>>
>>>I'm running Qmail on E-smith 5.6 Server and I get flooded with about 50 per
>>>day of these emails.
>>>
>>>Eg- 'Security Update' 'Bug Report' 'Microsoft Corporation' etc etc.
>>>
>>>I've installed spam assassin, but it doesn't seem to detect these as spam.
> This worked fine for me - add it to your system-wide SpamAssassin conf
> file or the local one as appropriate, and tweak the scoring to suit:
> score MICROSOFT_EXECUTABLE 10.0

That's not Spam, it's a worm called SWEN. You should scan your mail with
anti-virus-software. just plug it into qmail.

Achim

On Fri, 28 Nov 2003 17:08:54 +0100, Achim Keller wrote:

> Brian wrote:
>> On Sat, 22 Nov 2003 09:37:57 +0000, Ivor Cave wrote:
>>>Jamison wrote:
>>>>Hi
>>>>
>>>>I'm running Qmail on E-smith 5.6 Server and I get flooded with about 50 per
>>>>day of these emails.
>>>>
>>>>Eg- 'Security Update' 'Bug Report' 'Microsoft Corporation' etc etc.
>>>>
>>>>I've installed spam assassin, but it doesn't seem to detect these as spam.
>> This worked fine for me - add it to your system-wide SpamAssassin conf
>> file or the local one as appropriate, and tweak the scoring to suit:
>> score MICROSOFT_EXECUTABLE 10.0
>
> That's not Spam, it's a worm called SWEN. You should scan your mail with
> anti-virus-software. just plug it into qmail.
>
Er yes, I know it's a worm - embedded in spam.
But surely the point is, SpamAssassin traps it - and any other embedded M$
executable crud - along with spam.
Killing two birds with one stone?

B.
--
Whenever I feel blue, I start breathing again.