Silent viruses not silent anymore
Denis Beauchemin
Denis.Beauchemin at USHERBROOKE.CA
Mon May 5 15:15:32 IST 2003
Hello,
I am running mailscanner-4.14-9 and just found out that the silent virus
setting is not working:
Silent Viruses = /etc/MailScanner/rules/viruses.to.delete.conf
# cat /etc/MailScanner/rules/viruses.to.delete.conf
FromorTo: default W32/Klez W32/Yaha W32/Bugbear at MM W32/Braid W32/Korvar W32/Sobig W32/Lirva W32/Avril W32/Ganda W32/Lovgate W32/Gibe.gen at MM
I tried both with a Yaha and Gibe virus and I received 2 warnings.
Could this be related to a mod I made to SweepViruses.pm to translate
McAfee output to French (this used to work with previous versions):
# diff SweepViruses.pm SweepViruses.pm.orig
919,926d918
< # Modif de Denis Beauchemin le 20021210
< $currentline =~ s/Found the (.*) (virus) !!!/contient le \2 \1 !!!/;
< $currentline =~ s/Found the (.*) worm !!!/contient le ver \1 !!!/;
< # Modif de Denis Beauchemin le 20030103
< $currentline =~ s/Found the (.*) trojan !!!/contient le cheval de Troie \1 !!!/;
< # Modif de Denis Beauchemin le 20030313
< $currentline =~ s/Found trojan or variant (.*) !!!/contient le cheval de Troie \1 !!!/;
<
Here is an excerpt from my log:
May 5 09:47:43 MailScanner[32466]: Virus and Content Scanning: Starting
May 5 09:47:44 MailScanner[32466]: McAfee said "/var/spool/MailScanner/incoming/32466/h45DldY00518/gibe.exe"
May 5 09:47:44 MailScanner[32466]: McAfee said " Found the W32/Gibe.gen at MM virus !!!"
May 5 09:47:44 MailScanner[32466]: /h45DldY00518/gibe.exe contient le virus W32/Gibe.gen at MM !!!
May 5 09:47:44 MailScanner[32466]: Virus Scanning: McAfee found 1 infections
May 5 09:47:44 MailScanner[32466]: Virus Scanning: Found 1 viruses
May 5 09:47:44 MailScanner[32466]: Filename Checks: Fichiers EXE dangereux (gibe.exe)
May 5 09:47:44 MailScanner[32466]: Other Checks: Found 1 problems
May 5 09:47:44 MailScanner[32466]: Saved infected "gibe.exe" to /quarantaine/usherbrooke/20030505/h45DldY00518
May 5 09:47:44 MailScanner[32466]: Uninfected: Delivered 2 messages
May 5 09:47:44 MailScanner[32466]: Cleaned: Delivered 1 cleaned messages
May 5 09:47:44 MailScanner[32466]: Sender Warnings: Delivered 1 warnings to virus senders
Thanks again!
Denis
--
Denis Beauchemin, analyste
Université de Sherbrooke, S.T.I.
T: 819.821.8000x2252 F: 819.821.8045
More information about the MailScanner
mailing list