ANNOUNCE: F-Prot users

[Julian Field]

At 19:50 24/07/2002, you wrote:
>I am equally confused...
>I've been running f-prot v. 3.12a since it was released. Is the "changed
>output format" issue relevant to this version?
>If so, is the recent release of Mailscanner v. 3.22-5 the only version
>impacted by this issue?
>I'm currently running 3.20-6 (which seems to be working fine with version
>3.12a of f-prot) and wasn't planning on upgrading until this weekend. Am I
>currently at risk (or have I been at risk all this time)?

Search your MailScanner logs for "mass-mailing worm" and see if it produces
anything.
I have just checked my version of F-Prot (3.12a) and it produces this warning.

However, if you really don't want to upgrade, the patch is very simple:

817,818c817,819
<   if ($line =~ /(is|could be) a( boot sector)? virus dropper/) {
<     # Reparse the rest of the line to turn it into an infection report
---
 >   if ($line =~ /(is|could be) a mass-mailing worm/) {
 >     $line =~ s/(is|could be) a mass-mailing worm.*$/Infection: /;
 >   } elsif ($line =~ /(is|could be) a( boot sector)? virus dropper/) {

--
Julian Field                Teaching Systems Manager
jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                             Southampton SO17 1BJ