quarantine attachments & Dangerous content

Rick Chadderdon mailscanner at yeticomputers.com
Thu Aug 10 15:58:33 IST 2006

James D. Parra wrote:
> Hello,
> In my past installs of mailscanner, attachments considered 'suspect' for any
> various reason were put into quarantine for later retrieval. In the most
> recent install I made, these items are instead being deleted from the e-mail
> message with a note in the e-mail stating that attachment was removed. For
> example;
> The content filters found this:
>    MailScanner: Message contained password-protected archive
> Where in the MailScanner.conf can I specify to have suspect attachments
> stored or quarantined and *not* deleted. If it is not in the
> mailscanner.conf file is the setting in another config file? 
> Many thanks,
> James 

# Strings listed here will be searched for in the output of the virus 
# It works to achieve the opposite effect of the "Silent Viruses" listed 
# If a string here is found in the output of the virus scanners, then the
# message will be treated as if it were not infected with a "Silent Virus".
# If a message is detected as both a silent virus and a non-forging virus,
# then the ___non-forging status will override the silent status.___
# In simple terms, you should list virus names (or parts of them) that you
# know do *not* forge the From address.
# A good example of this is a document macro virus or a Joke program.
# Another word that can be put in this list is the special keyword
#    Zip-Password  : inserting this will cause senders to be warned about
#                    password-protected zip files, when they are not 
#                    This will over-ride the All-Viruses setting in the list
#                    of "Silent Viruses" above.
Non-Forging Viruses = Joke/ OF97/ WM97/ W97M/ eicar

More information about the MailScanner mailing list