Hi, I am new to this list, so please be gentle :-)
I have installed the MSExec.pm Plug-In to SpamAssassin 3.0 on Debian. SpamAssassin is called via procmal, individually per user.
The Plug-In works fine.
During testing, I found that I get executable content using the MIME type 'x-msdownload' instead of 'application/octet-stream'. Took me some time to find out why my test messages never triggered the plugin...
In my case, the mails are sent through Microsoft Outlook Web Access (aka OWA) on Exchange 2003 server.
To catch these as well, I did the following small change to the plugin:
- if (lc $ctype eq 'application/octet-stream') {
+ if (lc $ctype eq 'application/octet-stream' or lc $ctype eq 'application/x-msdownload' ) {
This is not likely necessary for worm-generated mails, but sometimes inconsiderate humans send out executables as well.
Hope this is of use to someone.
Cheers, Jan
