How to quarantine only Phishing stuff from Clam?

[Jeff A. Earickson]

On Thu, 10 Mar 2005, Julian Field wrote:

> Date: Thu, 10 Mar 2005 18:20:17 +0000
> From: Julian Field <MailScanner at ECS.SOTON.AC.UK>
> Reply-To: MailScanner mailing list <MAILSCANNER at JISCMAIL.AC.UK>
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: How to quarantine only Phishing stuff from Clam?
>
> Jeff A. Earickson wrote:
>
>> Julian,
>>
>> My daily report of who is sending viruses from our own domain has
>> been showing Phishing stuff caught by ClamAV, coming from my own
>> webmail server.
>>
>> A sample of what gets emailed to me via "Notices to", and then boiled
>> down by a perl script:
>>
>> j29LMw3X004268: 137.146.210.58 (username)
>> ClamAV Module: msg-21083-102.txt was infected: HTML.Phishing.Bank-111
>>
>> I want to investigate, ie quarantine the offending messages.  But I
>> don't want to quarantine tons of crap.  I have
>>
>> Quarantine Infections = yes
>> Quarantine Silent Viruses = no
>>
>> and I want to set up a ruleset specifying silent viruses.  Would this
>> be right?
>>
>> %localrules-dir% = /etc/MailScanner/rules
>> Silent Viruses = %localrules-dir%/silent-viruses.rules
>>
>> where the silent-viruses.rules looks like:
>>
>> Virus:  All-Viruses             yes
>> Virus:  HTML-IFrame             yes
>> Virus:  Phishing.Bank   no
>
> "yes" and "no" are not valid values for the "Silent Viruses" option. If
> you want to separate out the Phishing.Bank mail from the All-Viruses
> mail then just set
>
> Silent Viruses = All-Viruses HTML-IFrame
> Non-Forging Viruses = Phishing.Bank
>
> The non-forging list effectively cancels out the Silent Viruses list for
> any matching viruses.

I added Phishing to non-forging viruses, and had the side effect that people
got phishing emails tagged by Clam with subject lines like:

   Subject: {Spam?} {Virus?} Washington Mutual...

So I have removed Phishing from non-forging viruses, and decided to quarantine
all viruses and non-high spam until I figure my issue out.  Yuck.  This will
boost my disk load.

I suppose this raises the issue (again) of anti-spam vs anti-virus first in the
processing sequence.  Sure would be a nice feature if you could choose.

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!