On 02 Feb 2004, Brian Burton wrote:
> --On Thursday, January 29, 2004 11:13 AM +0100 Cedric Pradalier
> <cedric.pradalier@...> wrote:
> >I tried this solution. Unfortunately, with multipart message, clamav
> >will output one line for each part. So, if the virus is not the first
> >one, the rule ^X-Virus:.*FOUND may not work. You have to add -i flag,
> >which asks clamav to output only infected partl, but in this case,
> >X-Virus will be empty for non-infected file. Not very important...
>
> This isn't true if you assign the output of clamscan to a variable and then
> test that (as my procmail rule does). I have received an email like this
> (first two parts OK, last two parts viral) and the procmail rule caught it
> and filed it to my viral folder.
>
> All the best,
> ++Brian
I think I must be missing something quite basic about this worm stuff.
I've installed clamav and various procmail rules that people have
suggested but nothing ever appears as having been filtered. Possibly
this is because I never receive any (?), since the mail server I use
claims to scan all the mail from viruses thus:
> ________________________________________________________________________
> This email has been scanned using the CleanPort MEF antivirus system.
> Funded for members by the Doctors.net.uk Bulletin service How does
> this protect me? http://www.Doctors.net.uk/qualityemail
> ________________________________________________________________________
>
Nevertheless I still get occasional messages from hosts I don't know
telling me they have detected viruses in emails I haven't sent.
Presumably these are due to spammers who spoof my address. It's not a
great problem as far as I'm concerned but I'd prefer not to be sending
out these bogus emails if possible.
Can anyone illuminate what is happening here?
Anthony
--
ac@... || http://www.acampbell.org.uk
using Linux GNU/Debian || for book reviews, electronic
Windows-free zone || books and skeptical articles
|