Dumaru again

Chris Stone cstone at HMS.COM
Thu Mar 25 16:15:58 GMT 2004

Try changing in your rules file

FromOrTo:       @mydomain.de            yes


FromOrTo:       *@mydomain.de            yes

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf
Of Muenz, Michael
Sent: Thursday, March 25, 2004 8:35 AM
Subject: Dumaru again


On my Spamscanner machine I got a copy of that Dumaru worm.
With SCP i copied it to the machine where F-Prot and MailScanner
runs and did a manual check with F-Prot:
Results of virus scanning:

Files: 1
MBRs: 0
Boot sectors: 0
Objects scanned: 3
Infected: 1
Suspicious: 0
Disinfected: 0
Deleted: 0
Renamed: 0


But MailScanner hasn't detect it.
I got a rule in MailScanner for Virus Scan:
FromOrTo:       @mydomain.de            yes
FromOrTo:       default                         no

The infected mail was sent to:
Could it be that writing of rules is case sensitive ?

- Michael

More information about the MailScanner mailing list