malware

[David Stacey]

On 09/06/16 17:14, Corinna Vinschen wrote:
> On Jun  9 18:02, Marco Atzeri wrote:
>> On 09/06/2016 17:52, Jack Adrian Zappa wrote:
>>> Are you referring to the 83.dotm file?  Looks highly suspicious.  o.O
>>>
>> It is clearly spam or worse.
>>
>> But some of them will always pass whatever filter the cygwin mail
>> server is implementing.
>> Some of them are reaching any mailbox also company's one.
> I can only agree with Marco.  Sourceware is running an agressive spam
> assassin and what not which gets constantly upgraded and fed with known
> spam regulary to hone the filters.  However, there's*no*  way it will
> always catch all spam or virus or worm.  If so, it would probably also
> catch lots of legit mails.


In fairness to the Sourceware mail filter, VirusTotal isn't decided on 
whether the file is malevolent or not [1]. At present, all of the major 
commercial AV tools pass it as clean. If it turns out to be something 
unpleasant then we should request the postmaster delete the mail from 
the archives.

Dave.

[1] - 
https://www.virustotal.com/en/file/f2611880cfe199ef43f9de6d4b54c2fae06164a5ec2d321db086cab324954c6d/analysis/


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple