Turn off Virus?

Mon Oct 14 18:55:46 IST 2002

It may be only implemented in v4 which is what i'm running.  It *might* be
in 3.24-1, but I'm not for certain.

Kris

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
Behalf Of Bill Anderson
Sent: Monday, October 14, 2002 12:51 PM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: [MAILSCANNER] Turn off Virus?

Ok, I am totally confused.  I have no such file in my mailscanner.conf or in
my directory.  I am running version 3.23-4.  Am I missing something?

=======================
Bill Anderson
Sterling Communications
(503)885-8908 x225
bill at sterlink.net

=======================
Sterling Support
(503)885-8908 x223
support at sterling.net
http://www.sterling.net
=======================

For network status and outage information, please see:
http://www.sterling.net/support_networkstatus.asp

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Kris Stumpner
> Sent: Monday, October 14, 2002 10:24 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: Turn off Virus?
>
>
> >From the rules/EXAMPLES file:
>
> 5. Only virus scan some domains
>
>    Set "Virus Scanning = /opt/MailScanner/etc/rules/virus.scanning.rules".
>    FromOrTo:    *@scanme.com            yes
>    FromOrTo:    *@scanme-too.com        yes
>    FromOrTo:    default                 no
>
>
> put in
>
> FromOrTo: user at domain no
> FromOrTo: default     yes
>
> Kris
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Bill Anderson
> Sent: Monday, October 14, 2002 12:15 PM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: [MAILSCANNER] Turn off Virus?
>
>
> No, I will give that a try.  Is their a whitelist option for viruses?  I
> know it sounds silly to allow viruses from a specific email, however, we
> have an email coming from ZDNET to a customer that is a good
> email.  I can't
> tell which extension is being triggered.  I have checked the logs and this
> is what I get:
>
> Oct 14 05:49:52 xr400 sendmail[6382]: g9ECnpn06382:
> from=<Online#3.27911.3131323532353837.1.b at newsletter.online.com>,
> size=44841, class=0, nrcpts=1,
> msgid=<3629816.1034599786709.JavaMail.root at abv-sfo1-ac-agent4>,
> bodytype=8BITMIME, proto=ESMTP, daemon=MTA, relay=abv-sfo1-acmta1.cnet.com
> [206.16.1.160]
> Oct 14 05:49:52 xr400 sendmail[6382]: g9ECnpn06382:
> to=<somone at somedomain.com>, delay=00:00:01, mailer=esmtp, pri=74841,
> stat=queued
> Oct 14 05:49:58 xr400 mailscanner[555]: Detected
> Microsoft-specific exploits
> in g9ECnpn06382
> Oct 14 05:49:58 xr400 mailscanner[555]: Found 1 viruses in messages
> g9ECnpn06382
> Oct 14 05:49:58 xr400 mailscanner[555]: Saved entire message to
> /var/spool/MailScanner/quarantine/20021014/g9ECnpn06382
> Oct 14 05:49:59 xr400 sendmail[6388]: g9ECnpn06382:
> to=<somone at somedomain.com>, delay=00:00:08, xdelay=00:00:01, mailer=esmtp,
> pri=164841, relay=myrelay.net. [109.188.228.58], dsn=2.0.0, stat=Sent
> (g9ECnwh14680 Message accepted for delivery)
>
> =======================
> Bill Anderson
> Sterling Communications
> (503)885-8908 x225
> bill at sterlink.net
>
> =======================
> Sterling Support
> (503)885-8908 x223
> support at sterling.net
> http://www.sterling.net
> =======================
>
> For network status and outage information, please see:
> http://www.sterling.net/support_networkstatus.asp
>
>
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> > Behalf Of Kris Stumpner
> > Sent: Monday, October 14, 2002 10:09 AM
> > To: MAILSCANNER at JISCMAIL.AC.UK
> > Subject: Re: Turn off Virus?
> >
> >
> > did you try removing all the contents of the filenames.rules.conf file?
> >
> > Kris
> >
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> > Behalf Of Bill Anderson
> > Sent: Monday, October 14, 2002 12:03 PM
> > To: MAILSCANNER at JISCMAIL.AC.UK
> > Subject: Re: [MAILSCANNER] Turn off Virus?
> >
> >
> > Filename Rule = no does not work.  I am running v3.23-4 and
> when I change
> > that line to no, mailscanner errors out with the following message.
> >
> > Starting MailScanner daemons:
> >          incoming sendmail: [  OK  ]
> >          outgoing sendmail: [  OK  ]
> >          MailScanner:       Configuration file no could not be
> opened for
> > reading! at /usr/local/MailScanner/bin/logger.pl line 64.
> >
> > =======================
> > Bill Anderson
> > Sterling Communications
> > (503)885-8908 x225
> > bill at sterlink.net
> >
> > =======================
> > Sterling Support
> > (503)885-8908 x223
> > support at sterling.net
> > http://www.sterling.net
> > =======================
> >
> > For network status and outage information, please see:
> > http://www.sterling.net/support_networkstatus.asp
> >
> >
> > > -----Original Message-----
> > > From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> > > Behalf Of Kris Stumpner
> > > Sent: Monday, October 14, 2002 9:37 AM
> > > To: MAILSCANNER at JISCMAIL.AC.UK
> > > Subject: Re: Turn off Virus?
> > >
> > >
> > > try setting 'Filename Rules = no' in your mailscanner.conf
> > >
> > > Kris
> > >
> > > -----Original Message-----
> > > From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> > > Behalf Of Bill Anderson
> > > Sent: Monday, October 14, 2002 11:32 AM
> > > To: MAILSCANNER at JISCMAIL.AC.UK
> > > Subject: [MAILSCANNER] Turn off Virus?
> > >
> > >
> > > I have the virus scanner turned off in mailscanner.conf, however,
> > > mailscanner is still scanning messages with possible dangerous
> > > attachments.
> > > How do I turn off this feature as well?  Basically, all I want is spam
> > > filtering only.  Thanks.
> > >
> > > =======================
> > > Sterling Support
> > > (503)885-8908 x223
> > > support at sterling.net
> > > http://www.sterling.net
> > > =======================
> > >
> > > For network status and outage information, please see:
> > > http://www.sterling.net/support_networkstatus.asp
> > >
> >
>