Bug? in syslog infection messages

[Julian Field]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

What virus scanner are you using? (And if it's Sophos or ClamAV then  
the module version or the command-line version?)

On 6 Jun 2005, at 13:56, Richard Lynch wrote:

> I upgraded to the latest stable over the weekend.  The infection  
> messages in the syslog are now formatted like this...
>
> Jun  6 04:33:33 helen MailScanner[9301]: ./eyghn.zip->eyghn.htm  
> Infection: W32/Mytob.EK at mm
>
> Prior to the upgrade the messages are formatted like this...
>
> Jun  4 04:16:30 barney MailScanner[18024]: /var/spool/MailScanner/ 
> incoming/18024/j548EsXL032151/tyve.scr  Infection: W32/Mytob.CZ at mm
>
> Note that the full path is missing.  Unfortunately, I'm counting on  
> the old message format in order to tie an infected message back to  
> the sending site and targeted user.  I'm using the message-id to do  
> that.  This is used for reports which I send to customers.  Is  
> there an easy way to return to the old message format?
>
> Richard Lynch
> WVNET
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
>

- -- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.0.1 (Build 2185)

iQA/AwUBQqV8gBH2WUcUFbZUEQLYEACfd/LCqUTFV+Ih9lzhF/aW0nCnIk8Anikk
xuO926M/XImn/vH2iDFUK8Ry
=HfGx
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!