Turn off Virus?

[Kris Stumpner]

>From the rules/EXAMPLES file:

5. Only virus scan some domains

   Set "Virus Scanning = /opt/MailScanner/etc/rules/virus.scanning.rules".
   FromOrTo:    *@scanme.com            yes
   FromOrTo:    *@scanme-too.com        yes
   FromOrTo:    default                 no


put in

FromOrTo: user at domain no
FromOrTo: default     yes

Kris

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
Behalf Of Bill Anderson
Sent: Monday, October 14, 2002 12:15 PM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: [MAILSCANNER] Turn off Virus?


No, I will give that a try.  Is their a whitelist option for viruses?  I
know it sounds silly to allow viruses from a specific email, however, we
have an email coming from ZDNET to a customer that is a good email.  I can't
tell which extension is being triggered.  I have checked the logs and this
is what I get:

Oct 14 05:49:52 xr400 sendmail[6382]: g9ECnpn06382:
from=<Online#3.27911.3131323532353837.1.b at newsletter.online.com>,
size=44841, class=0, nrcpts=1,
msgid=<3629816.1034599786709.JavaMail.root at abv-sfo1-ac-agent4>,
bodytype=8BITMIME, proto=ESMTP, daemon=MTA, relay=abv-sfo1-acmta1.cnet.com
[206.16.1.160]
Oct 14 05:49:52 xr400 sendmail[6382]: g9ECnpn06382:
to=<somone at somedomain.com>, delay=00:00:01, mailer=esmtp, pri=74841,
stat=queued
Oct 14 05:49:58 xr400 mailscanner[555]: Detected Microsoft-specific exploits
in g9ECnpn06382
Oct 14 05:49:58 xr400 mailscanner[555]: Found 1 viruses in messages
g9ECnpn06382
Oct 14 05:49:58 xr400 mailscanner[555]: Saved entire message to
/var/spool/MailScanner/quarantine/20021014/g9ECnpn06382
Oct 14 05:49:59 xr400 sendmail[6388]: g9ECnpn06382:
to=<somone at somedomain.com>, delay=00:00:08, xdelay=00:00:01, mailer=esmtp,
pri=164841, relay=myrelay.net. [109.188.228.58], dsn=2.0.0, stat=Sent
(g9ECnwh14680 Message accepted for delivery)

=======================
Bill Anderson
Sterling Communications
(503)885-8908 x225
bill at sterlink.net

=======================
Sterling Support
(503)885-8908 x223
support at sterling.net
http://www.sterling.net
=======================

For network status and outage information, please see:
http://www.sterling.net/support_networkstatus.asp


> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Kris Stumpner
> Sent: Monday, October 14, 2002 10:09 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: Turn off Virus?
>
>
> did you try removing all the contents of the filenames.rules.conf file?
>
> Kris
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Bill Anderson
> Sent: Monday, October 14, 2002 12:03 PM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: [MAILSCANNER] Turn off Virus?
>
>
> Filename Rule = no does not work.  I am running v3.23-4 and when I change
> that line to no, mailscanner errors out with the following message.
>
> Starting MailScanner daemons:
>          incoming sendmail: [  OK  ]
>          outgoing sendmail: [  OK  ]
>          MailScanner:       Configuration file no could not be opened for
> reading! at /usr/local/MailScanner/bin/logger.pl line 64.
>
> =======================
> Bill Anderson
> Sterling Communications
> (503)885-8908 x225
> bill at sterlink.net
>
> =======================
> Sterling Support
> (503)885-8908 x223
> support at sterling.net
> http://www.sterling.net
> =======================
>
> For network status and outage information, please see:
> http://www.sterling.net/support_networkstatus.asp
>
>
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> > Behalf Of Kris Stumpner
> > Sent: Monday, October 14, 2002 9:37 AM
> > To: MAILSCANNER at JISCMAIL.AC.UK
> > Subject: Re: Turn off Virus?
> >
> >
> > try setting 'Filename Rules = no' in your mailscanner.conf
> >
> > Kris
> >
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> > Behalf Of Bill Anderson
> > Sent: Monday, October 14, 2002 11:32 AM
> > To: MAILSCANNER at JISCMAIL.AC.UK
> > Subject: [MAILSCANNER] Turn off Virus?
> >
> >
> > I have the virus scanner turned off in mailscanner.conf, however,
> > mailscanner is still scanning messages with possible dangerous
> > attachments.
> > How do I turn off this feature as well?  Basically, all I want is spam
> > filtering only.  Thanks.
> >
> > =======================
> > Sterling Support
> > (503)885-8908 x223
> > support at sterling.net
> > http://www.sterling.net
> > =======================
> >
> > For network status and outage information, please see:
> > http://www.sterling.net/support_networkstatus.asp
> >
>