On Thursday, October 16, 2003, at 04:32 PM, Stefan Schoeman wrote:
Hi everyone,
I am new to this list but have been using ClamAV with good results
together with MIMEDefang (www.mimedefang.org) and sendmail. MIMEDefang is
a general purpose perl programmable mail filter that caters for detecting
viruses with a number of anti-virus scanners (incl ClamAV), spam through
SpamAssassin and also filtering by file type, subject, sender, recipient,
relay info and so on. It contains all the functionality to alter mail,
strip attachments, bounce the mail, quarantine attachments and much more.
Reading through the ClamAV archives and seeing the issues raised there,
many of them can be addressed by MIMEDefang. But anyway, everyone here
probably knows that and I'm not really writing to punt MIMEDefang
(although I think it is great ;)
What I am writing about is to hear whether the authors of ClamAV would
perhaps consider providing support for another database in ClamAV. This
would not really be a Virus database, but a database of Spam attachments.
Basically, it appears that a modern trend in spamming is now to not send
HTML or text, but to rather send an image containing the spam message. The
mail one receives is almost blank and just contains the image - sometimes
with a tiny piece of HTML to make the image clickable. This fools content
filters such as SpamAssassin, because there is no content per se. With
SpamAssassin effectively ineffective against this, the spam simply passes
through.
Anti-Virus scanners on the other hand are actually in a position to identify an attachment as Spam if it had a signature or a hash of the offending image.
I was wondering what it would take to add another database to ClamAV
(something like spam.db) that could also be used in scanning for spam. I
would think that this should be fairly easy to implement into clamscan and
freshclam and anyone using ClamAV for filtering incoming mail would
inherit identification of this type of spam.
My apologies if this suggestion has been made before - I did a search for
"Spam" in the mailing list archives, but did not find a suggestion in this
line.
Regards,
Stefan
------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the people who have HELPED US provide better services: Click here: http://sourceforge.net/supporters.php _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the people who have HELPED US provide better services: Click here: http://sourceforge.net/supporters.php _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
