ANNOUNCE: F-Prot users

[Nathan Johanson]

I searched for th string and didn't find it. We're not a high traffic site,
so it's possible we haven't received anything to trigger it.
I'll go ahead and upgrade this evening. Thanks Julian.
-Nathan
----- Original Message -----
From: "Julian Field" <mailscanner at ECS.SOTON.AC.UK>
To: <MAILSCANNER at JISCMAIL.AC.UK>
Sent: Wednesday, July 24, 2002 12:39 PM
Subject: Re: ANNOUNCE: F-Prot users


> At 19:50 24/07/2002, you wrote:
> >I am equally confused...
> >I've been running f-prot v. 3.12a since it was released. Is the "changed
> >output format" issue relevant to this version?
> >If so, is the recent release of Mailscanner v. 3.22-5 the only version
> >impacted by this issue?
> >I'm currently running 3.20-6 (which seems to be working fine with version
> >3.12a of f-prot) and wasn't planning on upgrading until this weekend. Am
I
> >currently at risk (or have I been at risk all this time)?
>
> Search your MailScanner logs for "mass-mailing worm" and see if it
produces
> anything.
> I have just checked my version of F-Prot (3.12a) and it produces this
warning.
>
> However, if you really don't want to upgrade, the patch is very simple:
>
> 817,818c817,819
> <   if ($line =~ /(is|could be) a( boot sector)? virus dropper/) {
> <     # Reparse the rest of the line to turn it into an infection report
> ---
>  >   if ($line =~ /(is|could be) a mass-mailing worm/) {
>  >     $line =~ s/(is|could be) a mass-mailing worm.*$/Infection: /;
>  >   } elsif ($line =~ /(is|could be) a( boot sector)? virus dropper/) {
>
> --
> Julian Field                Teaching Systems Manager
> jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
> Tel. 023 8059 2817          University of Southampton
>                              Southampton SO17 1BJ