ANNOUNCE: F-Prot users

[Julian Field]

At 21:26 24/07/2002, you wrote:
>I searched for th string and didn't find it. We're not a high traffic site,
>so it's possible we haven't received anything to trigger it.
>I'll go ahead and upgrade this evening. Thanks Julian.

By the mere fact that no-one else has reported it before, it must only
appear very rarely. Unfortunately, getting the definitive list of strings
out of F-Prot is a non-trivial task (involves the Zip of Death and a core
dump :-)

>-Nathan
>----- Original Message -----
>From: "Julian Field" <mailscanner at ECS.SOTON.AC.UK>
>To: <MAILSCANNER at JISCMAIL.AC.UK>
>Sent: Wednesday, July 24, 2002 12:39 PM
>Subject: Re: ANNOUNCE: F-Prot users
>
>
> > At 19:50 24/07/2002, you wrote:
> > >I am equally confused...
> > >I've been running f-prot v. 3.12a since it was released. Is the "changed
> > >output format" issue relevant to this version?
> > >If so, is the recent release of Mailscanner v. 3.22-5 the only version
> > >impacted by this issue?
> > >I'm currently running 3.20-6 (which seems to be working fine with version
> > >3.12a of f-prot) and wasn't planning on upgrading until this weekend. Am
>I
> > >currently at risk (or have I been at risk all this time)?
> >
> > Search your MailScanner logs for "mass-mailing worm" and see if it
>produces
> > anything.
> > I have just checked my version of F-Prot (3.12a) and it produces this
>warning.
> >
> > However, if you really don't want to upgrade, the patch is very simple:
> >
> > 817,818c817,819
> > <   if ($line =~ /(is|could be) a( boot sector)? virus dropper/) {
> > <     # Reparse the rest of the line to turn it into an infection report
> > ---
> >  >   if ($line =~ /(is|could be) a mass-mailing worm/) {
> >  >     $line =~ s/(is|could be) a mass-mailing worm.*$/Infection: /;
> >  >   } elsif ($line =~ /(is|could be) a( boot sector)? virus dropper/) {
> >
> > --
> > Julian Field                Teaching Systems Manager
> > jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
> > Tel. 023 8059 2817          University of Southampton
> >                              Southampton SO17 1BJ

--
Julian Field                Teaching Systems Manager
jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                             Southampton SO17 1BJ