Dangerous Content

[makii]

Hi,

I've got a lot of spam/virou mails contains a link to webpage with virus files.
What kind of rule can I use to remove this emails ?

regards,
Chris

 

[dietmar]

That depends on the content of such mails. First step is to gather those mails in raw (eml) format. I can analyze them if you send me a copy (<dietmar@proxmox.com>). Please zip them.

 

[makii]

Did you get my email ?

 

[dietmar]

yes, but I message is not enough - don't you have more such mails?

 

[dietmar]

OK, I receive no further examples from you, so I can't create an efficient test. Anyways, I can show you how to create a custom Spamassassin test rule.

First, login on you proxmox mailgateway. The edit:

# vi /etc/mail/spamassassin/custom.cf

uri TESTRULE /smartcardgreeting.com\/\?id\=22a9665cdd1787182079651/
score TESTRULE 2

the manual page has a verbose description of the format:

# man Mail::SpamAssassin::Conf

To test the syntax of the file you can use:

# spamassassin -D --lint

To test if it work store an example mail in raw format 'tesmail.eml':

# spamassassin -t testmail.eml

hope that helps.

- Dietmar