Bug? in syslog infection messages

[Julian Field]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In SweepViruses.pm swap over lines 1920 and 1921.
They should currently say:

   $logout =~ s/^.+\/(.+\/.+$)/\.\/$1/; # New
   MailScanner::Log::InfoLog($logout);

and you probably want

   MailScanner::Log::InfoLog($logout);
   $logout =~ s/^.+\/(.+\/.+$)/\.\/$1/; # New

instead.


On 7 Jun 2005, at 13:36, Richard Lynch wrote:

> Julian Field wrote:
>
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> What virus scanner are you using? (And if it's Sophos or ClamAV  
>> then  the module version or the command-line version?)
>>
>>
> Sorry, I should have mentioned that I'm running F-Prot.  I'm also  
> running ClamAV in command line mode.  The output from ClamAV does  
> include the full path.
>
> -- Rich
>
>
>
>> On 6 Jun 2005, at 13:56, Richard Lynch wrote:
>>
>>
>>
>>> I upgraded to the latest stable over the weekend.  The infection   
>>> messages in the syslog are now formatted like this...
>>>
>>> Jun  6 04:33:33 helen MailScanner[9301]: ./eyghn.zip->eyghn.htm   
>>> Infection: W32/Mytob.EK at mm
>>>
>>> Prior to the upgrade the messages are formatted like this...
>>>
>>> Jun  4 04:16:30 barney MailScanner[18024]: /var/spool/ 
>>> MailScanner/ incoming/18024/j548EsXL032151/tyve.scr  Infection:  
>>> W32/Mytob.CZ at mm
>>>
>>> Note that the full path is missing.  Unfortunately, I'm counting  
>>> on  the old message format in order to tie an infected message  
>>> back to  the sending site and targeted user.  I'm using the  
>>> message-id to do  that.  This is used for reports which I send to  
>>> customers.  Is  there an easy way to return to the old message  
>>> format?
>>>
>>> Richard Lynch
>>> WVNET
>>>
>>>
>
>
> -- 
>
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> <rich.vcf>
>

- -- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.0.1 (Build 2185)

iQA/AwUBQqWamRH2WUcUFbZUEQKesgCgoZpVrVSt1l5OxWZLkD8+q5gYXqEAn19Q
J6TsclMOnXxxbSKooruH2PFN
=Mkyz
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!