Re: [Spamprobe-users] Catching these new worms

[Cedric P. <ced...@in...>]

On Wed, 28 Jan 2004 12:02:13 +0000
Anthony Campbell <ac...@ac...> wrote:

> > I have it running from a Procmail rule along side SpamProbe without
> > any problems.  Best of all, of course, is that it's free!
> > 
> > Mike
> 
> What procmail rule are you using for this?
> 
> Anthony
> 

This is indeed a good question. I've been fighting clamav to have a
result usable in procmail. Finally, I wrapped it in the following
script. I'm new to clamav. So maybe there is a more handsome solution.

-------------------------------------------
#!/bin/sh
#this script is called mailscan in the procmail rules
DIAG=`clamscan --mbox --stdout --disable-summary -i - `
if test "$?" == "0"
then
        echo "Passed"
else 
        echo $DIAG | sed -e 's/[^:]*: //'
fi
-------------------------------------------
Procmail uses mailscan as follows :
-------------------------------------------
:0 
AVOUT=| mailscan
:0 wf
| formail -I "X-ClamAV: $AVOUT"
:0 
* ^X-ClamAV:.*FOUND
Spam/
-------------------------------------------
In sane mails I got a nice header 
X-ClamAV: Passed
in viruses I got : 
X-ClamAV: WORM blabla FOUND

-- 
Cedric

"[Of course] I'm French! Why do think I have this outrageous 
accent, you silly king-a?!"  Monty Python and the Holy Grail