Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: ClamAV: users

New kind of phissing mail

 

 

ClamAV users RSS feed   Index | Next | Previous | View Threaded


jack at jarasoft

Jul 30, 2009, 11:02 AM

Post #1 of 2 (636 views)
Permalink
New kind of phissing mail

Today I received a new kind of phissing mail.

Spamassassin (freebsd), clamav (freebsd) and avg (windows) didn't recognised it.

The email had an attached word file in which the phissing was written.

Yes today I won one million pound in the UK, but I have to fetch the money in south-africa :-)

You have been warned..

Jack
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


Dan.McDonald at austinenergy

Jul 30, 2009, 11:18 AM

Post #2 of 2 (575 views)
Permalink
Re: New kind of phissing mail [In reply to]

On Thu, 2009-07-30 at 20:02 +0200, Jack Raats wrote:
> Today I received a new kind of phissing mail.
>
> Spamassassin (freebsd), clamav (freebsd) and avg (windows) didn't recognised it.
>
> The email had an attached word file in which the phissing was written.

Yes, its a variation of one that as tried a couple of months ago. Last
time they used RTF format. Now bona-fide word docs.

>
> Yes today I won one million pound in the UK, but I have to fetch the money in south-africa :-)

it shows up in razor-agent. Not hard to defeat that, so we will need a
longer-term strategy.. There was some discussion on the SpamAssassin
list a couple of weeks ago of a plugin to grab word files and strip out
the text using wvText or some-such. then tossing that all into
SpamAssassin for regularization and rules.

--
Daniel J McDonald, CCIE # 2495, CISSP # 78281, CNX
www.austinenergy.com
Attachments: signature.asc (0.19 KB)

ClamAV users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.