Re: new Mail-SpamAssassin-Plugin-AttachmentPresent

2016-09-06 Thread David B Funk
On Tue, 6 Sep 2016, Dianne Skoll wrote: On Tue, 6 Sep 2016 17:50:25 -0400 Alex wrote: [snip] Workbook_Open Document_Open Auto_Open AutoOpen Is there a simple way to identify whether the attachment/macro contains those listed functions, without the ab

Re: new Mail-SpamAssassin-Plugin-AttachmentPresent

2016-09-06 Thread Dianne Skoll
On Tue, 6 Sep 2016 17:50:25 -0400 Alex wrote: [snip] > > Workbook_Open > > Document_Open > > Auto_Open > > AutoOpen > Is there a simple way to identify whether the attachment/macro > contains those listed functions, without the ability to use > mimedefang?

Re: new Mail-SpamAssassin-Plugin-AttachmentPresent

2016-09-06 Thread Alex
Hi, On Tue, Sep 6, 2016 at 5:40 PM, Dianne Skoll wrote: > On Tue, 6 Sep 2016 16:12:36 -0500 (CDT) > David B Funk wrote: > >> What is 'acceptable' to you? Unless you find some magical prescient >> anti-virus that can accurately predict all possible macro viruses >> with out FPs I don't know what

Re: new Mail-SpamAssassin-Plugin-AttachmentPresent

2016-09-06 Thread Dianne Skoll
On Tue, 6 Sep 2016 16:12:36 -0500 (CDT) David B Funk wrote: > What is 'acceptable' to you? Unless you find some magical prescient > anti-virus that can accurately predict all possible macro viruses > with out FPs I don't know what else can be done. Almost all of the macro viruses I've seen have

Re: new Mail-SpamAssassin-Plugin-AttachmentPresent

2016-09-06 Thread li...@rhsoft.net
Am 06.09.2016 um 23:27 schrieb Alex: Is there any ability to determine if a particular attachment has a Word macro enclosed in addition to just having a Word document? that's the hob of clamav and the sa-plugin for it "OLE2BlockMacros yes" in case of a scored SA plugin won't block but add th

Re: new Mail-SpamAssassin-Plugin-AttachmentPresent

2016-09-06 Thread Alex
Hi, Is there any ability to determine if a particular attachment has a Word macro enclosed in addition to just having a Word document? >>> >>> >>> that's the hob of clamav and the sa-plugin for it >>> >>> "OLE2BlockMacros yes" in case of a scored SA plugin won't block but add >>> the >>>

Re: new Mail-SpamAssassin-Plugin-AttachmentPresent

2016-09-06 Thread David B Funk
On Tue, 6 Sep 2016, Alex wrote: Hi, Is there any ability to determine if a particular attachment has a Word macro enclosed in addition to just having a Word document? that's the hob of clamav and the sa-plugin for it "OLE2BlockMacros yes" in case of a scored SA plugin won't block but add th

Re: new Mail-SpamAssassin-Plugin-AttachmentPresent

2016-09-06 Thread li...@rhsoft.net
Am 06.09.2016 um 22:40 schrieb Alex: Is there any ability to determine if a particular attachment has a Word macro enclosed in addition to just having a Word document? that's the hob of clamav and the sa-plugin for it "OLE2BlockMacros yes" in case of a scored SA plugin won't block but add th

Re: new Mail-SpamAssassin-Plugin-AttachmentPresent

2016-09-06 Thread Alex
Hi, >> Is there any ability to determine if a particular attachment has a >> Word macro enclosed in addition to just having a Word document? > > that's the hob of clamav and the sa-plugin for it > > "OLE2BlockMacros yes" in case of a scored SA plugin won't block but add the > score of that clamd-i

Re: new Mail-SpamAssassin-Plugin-AttachmentPresent

2016-09-06 Thread li...@rhsoft.net
Am 06.09.2016 um 22:24 schrieb Alex: Is there any ability to determine if a particular attachment has a Word macro enclosed in addition to just having a Word document? that's the hob of clamav and the sa-plugin for it "OLE2BlockMacros yes" in case of a scored SA plugin won't block but add t

Re: new Mail-SpamAssassin-Plugin-AttachmentPresent

2016-09-06 Thread Alex
Hi, On Tue, Sep 6, 2016 at 8:57 AM, Merijn van den Kroonenberg wrote: > Hello List, > > I decided to publish a SA Plugin we use over here. > The Plugin will check if attachments with a certain file extension are > present in the mail. This can be either directly attached or inside a zip > archive

Re: I have some bad news

2016-09-06 Thread doark
On Mon, 05 Sep 2016 20:17:18 "Bill Cole" wrote: > On 4 Sep 2016, at 21:11, @lbutlr wrote: > > > On Sep 1, 2016, at 7:41 PM, David Niklas > > > <[do...@mail.com]()> wrote: > >> > >> Would you like to go out to lunch? > > > > Other than your message, that phrase does not

Re: What are the T_ rules ?

2016-09-06 Thread Matus UHLAR - fantomas
On Mon, 5 Sep 2016, Ian Zimmerman wrote: I want to use RP_MATCHES_RCVD in a meta rule. I thought I'd check its definition before I plunged in and wrote any code, so I grepped in /usr/share/spamassassin where all the original rules seem to live on my system (debian jessie). But all the hits are

new Mail-SpamAssassin-Plugin-AttachmentPresent

2016-09-06 Thread Merijn van den Kroonenberg
Hello List, I decided to publish a SA Plugin we use over here. The Plugin will check if attachments with a certain file extension are present in the mail. This can be either directly attached or inside a zip archive. It only supports zip and no other archive types (yet). Its useful to create sco

Re: What are the T_ rules ?

2016-09-06 Thread li...@rhsoft.net
Am 06.09.2016 um 00:14 schrieb @lbutlr: On 05 Sep 2016, at 13:36, li...@rhsoft.net wrote: but -1.653 is just a bad joke because it means every homeuser which manages to get some DNS records fine (as well as every spammer which registers a ton of domains and cheap hosts) get a large benefit c