ANNOUNCE: more bug fixes

Ben C. O. Grimm mailscanner-sub at WIREHUB.NET
Tue Oct 22 20:54:05 IST 2002


On 22 Oct 2002 21:50:33 +0200, "Ben C. O. Grimm"
<mailscanner-sub at WIREHUB.NET> wrote:

> On 22 Oct 2002 21:47:38 +0200, Julian Field <mailscanner at ECS.SOTON.AC.UK>
> wrote:
>
> > Yes. If "Deliver Cleaned Messages" was set to "no", it was deleting the
> > message to stop it being delivered. That also stopped any
> > warnings/notifications being sent about it.
> >
> > It still gets deleted but another flags "stillwarn" gets set which triggers
> > the warnings/notifications to still be sent even after the message is
> > deleted. "deleted" isn't as major as it sounds, it just deletes the message
> > off disk and sets a flag in the data structure.
>
> One small side-effect with the EICAR test: the sender gets notified (good),
> the intended recipient doesn't (good), the postmaster doesn't (bad). In
> case of a Silent Virus, the sender does not get notified (good), the
> recipient does not get notified (good), but the postmaster does (good).

Hold on, more logs coming in .. oh no ...

Oct 22 21:50:50 ns-ams MailScanner[59295]: /g9MJoieN060126/passionup.scr
Found the W32/Yaha.g at MM virus !!!
Oct 22 21:50:50 ns-ams MailScanner[59295]: Filename Checks: Possible virus
hidden in a screensaver (passionup.scr)
Oct 22 21:50:50 ns-ams MailScanner[59295]: HTML IFrame tag found in message
from aliap at bla
Oct 22 21:50:50 ns-ams MailScanner[59295]: Content Checks: Detected
Microsoft-specific exploits in g9MJoieN060126

and

Oct 22 21:50:51 ns-ams MailScanner[59295]: Sender Warnings: Delivered 1
warnings to virus senders

This one is in Silent Viruses ....



More information about the MailScanner mailing list