>> [snip]
>> body HAS_VBS_FILES eval:attachmentpresent_file_count('vbs')
>> describe HAS_VBS_FILES The e-mail has attached vbs files (or inside
>> archives)
>> score HAS_VBS_FILES 2.5
>
> This looks very interesting. The scores you've specified seem to be
> quite high, however. I'd probably make t
On Tue, 6 Sep 2016, Dianne Skoll wrote:
On Tue, 6 Sep 2016 17:50:25 -0400
Alex wrote:
[snip]
Workbook_Open
Document_Open
Auto_Open
AutoOpen
Is there a simple way to identify whether the attachment/macro
contains those listed functions, without the ab
On Tue, 6 Sep 2016 17:50:25 -0400
Alex wrote:
[snip]
> > Workbook_Open
> > Document_Open
> > Auto_Open
> > AutoOpen
> Is there a simple way to identify whether the attachment/macro
> contains those listed functions, without the ability to use
> mimedefang?
Hi,
On Tue, Sep 6, 2016 at 5:40 PM, Dianne Skoll wrote:
> On Tue, 6 Sep 2016 16:12:36 -0500 (CDT)
> David B Funk wrote:
>
>> What is 'acceptable' to you? Unless you find some magical prescient
>> anti-virus that can accurately predict all possible macro viruses
>> with out FPs I don't know what
On Tue, 6 Sep 2016 16:12:36 -0500 (CDT)
David B Funk wrote:
> What is 'acceptable' to you? Unless you find some magical prescient
> anti-virus that can accurately predict all possible macro viruses
> with out FPs I don't know what else can be done.
Almost all of the macro viruses I've seen have
Am 06.09.2016 um 23:27 schrieb Alex:
Is there any ability to determine if a particular attachment has a
Word macro enclosed in addition to just having a Word document?
that's the hob of clamav and the sa-plugin for it
"OLE2BlockMacros yes" in case of a scored SA plugin won't block but add
th
Hi,
Is there any ability to determine if a particular attachment has a
Word macro enclosed in addition to just having a Word document?
>>>
>>>
>>> that's the hob of clamav and the sa-plugin for it
>>>
>>> "OLE2BlockMacros yes" in case of a scored SA plugin won't block but add
>>> the
>>>
On Tue, 6 Sep 2016, Alex wrote:
Hi,
Is there any ability to determine if a particular attachment has a
Word macro enclosed in addition to just having a Word document?
that's the hob of clamav and the sa-plugin for it
"OLE2BlockMacros yes" in case of a scored SA plugin won't block but add th
Am 06.09.2016 um 22:40 schrieb Alex:
Is there any ability to determine if a particular attachment has a
Word macro enclosed in addition to just having a Word document?
that's the hob of clamav and the sa-plugin for it
"OLE2BlockMacros yes" in case of a scored SA plugin won't block but add th
Hi,
>> Is there any ability to determine if a particular attachment has a
>> Word macro enclosed in addition to just having a Word document?
>
> that's the hob of clamav and the sa-plugin for it
>
> "OLE2BlockMacros yes" in case of a scored SA plugin won't block but add the
> score of that clamd-i
Am 06.09.2016 um 22:24 schrieb Alex:
Is there any ability to determine if a particular attachment has a
Word macro enclosed in addition to just having a Word document?
that's the hob of clamav and the sa-plugin for it
"OLE2BlockMacros yes" in case of a scored SA plugin won't block but add
t
Hi,
On Tue, Sep 6, 2016 at 8:57 AM, Merijn van den Kroonenberg
wrote:
> Hello List,
>
> I decided to publish a SA Plugin we use over here.
> The Plugin will check if attachments with a certain file extension are
> present in the mail. This can be either directly attached or inside a zip
> archive
Hello List,
I decided to publish a SA Plugin we use over here.
The Plugin will check if attachments with a certain file extension are
present in the mail. This can be either directly attached or inside a zip
archive.
It only supports zip and no other archive types (yet).
Its useful to create sco
13 matches
Mail list logo
