From jon.bates at summitmotors.com.au Fri Dec 1 04:01:10 2006 From: jon.bates at summitmotors.com.au (Jon Bates) Date: Fri Dec 1 04:01:25 2006 Subject: Viruses being blocked by filename rules, not being picked up by ClamAV Message-ID: <200612010401.kB141BNf023636@summitmotors.com.au> I've changed something, and viruses are no longer being picked up by Clamav, but they are being picked up by the filename rules blocking executables instead. I checked the obvious settings (Virus Scanning, Virus Scanner Definitions etc).. I'm not sure what I've done to cause this. It's obviously having a negative affect on my reporting, as well as causing my server trying to send 'blocked filename' reports to the spoofed sender addresses of the virus emails - eek! Any suggestions would be appreciated. Thanks! Jon From r.berber at computer.org Fri Dec 1 04:26:54 2006 From: r.berber at computer.org (=?ISO-8859-1?Q?Ren=E9_Berber?=) Date: Fri Dec 1 04:27:06 2006 Subject: Viruses being blocked by filename rules, not being picked up by ClamAV In-Reply-To: <200612010401.kB141BNf023636@summitmotors.com.au> References: <200612010401.kB141BNf023636@summitmotors.com.au> Message-ID: Jon Bates wrote: > > I've changed something, and viruses are no longer being picked up by Clamav, > but they are being picked up by the filename rules blocking executables > instead. I checked the obvious settings (Virus Scanning, Virus Scanner > Definitions etc).. > > I'm not sure what I've done to cause this. It's obviously having a negative > affect on my reporting, as well as causing my server trying to send 'blocked > filename' reports to the spoofed sender addresses of the virus emails - eek! > > Any suggestions would be appreciated. What version of clamav do you have installed? I'm not sure but there was some reports about 0.90rc2 not working with MS, you can revert to 0.88.6 . Check the obvious, does the MS log show that messages are being scanned for viruses? If not, then check MS configuration file, see if clamavmodule is set in "Virus Scanners". -- Ren? Berber From jon.bates at summitmotors.com.au Fri Dec 1 05:35:38 2006 From: jon.bates at summitmotors.com.au (Jon Bates) Date: Fri Dec 1 05:35:47 2006 Subject: Viruses being blocked by filename rules, not being picked up by ClamAV Message-ID: <200612010535.kB15ZdbF013064@summitmotors.com.au> Ren? Berber Wrote: > What version of clamav do you have installed? I'm not sure but there was some > reports about 0.90rc2 not working with MS, you can revert to 0.88.6 . > Check the obvious, does the MS log show that messages are being scanned for viruses? > If not, then check MS configuration file, see if clamavmodule is set in "Virus > Scanners". > -- > Ren? Berber Thanks for the reply Rene, Current ClamAV version is 0.88.6. Log shows: Dec 1 16:31:43 MailScanner[28665]: New Batch: Found 2 messages waiting Dec 1 16:31:43 MailScanner[28665]: New Batch: Scanning 1 messages, 10461 bytes Dec 1 16:31:44 MailScanner[28515]: Virus and Content Scanning: Starting ... so I assume this means that it's working? Option: Virus Scanners = clamav There's nothing obvious that I can see from that :( From febrianto at sioenasia.com Fri Dec 1 06:21:33 2006 From: febrianto at sioenasia.com (Budi Febrianto) Date: Fri Dec 1 06:16:42 2006 Subject: Viruses being blocked by filename rules, not being picked up by ClamAV In-Reply-To: <200612010535.kB15ZdbF013064@summitmotors.com.au> Message-ID: mailscanner-bounces@lists.mailscanner.info wrote on 12/01/2006 12:35:38 PM: > Ren? Berber Wrote: > > > What version of clamav do you have installed? I'm not sure but there was > some > > reports about 0.90rc2 not working with MS, you can revert to 0.88.6 . > > > Check the obvious, does the MS log show that messages are being scanned > for viruses? > > > If not, then check MS configuration file, see if clamavmodule is set in > "Virus > > Scanners". > > -- > > Ren? Berber > > > Thanks for the reply Rene, > > Current ClamAV version is 0.88.6. > > Log shows: > > Dec 1 16:31:43 MailScanner[28665]: New Batch: Found 2 messages waiting > Dec 1 16:31:43 MailScanner[28665]: New Batch: Scanning 1 messages, 10461 > bytes > Dec 1 16:31:44 MailScanner[28515]: Virus and Content Scanning: Starting > > ... so I assume this means that it's working? > > Option: Virus Scanners = clamav > > > There's nothing obvious that I can see from that :( I think I have the same problem, not exactly the same. Viruses are still detected, but there are some suspicous virus but not detected by clamav, but by filename rules. One of the file is update-something.exe. MailScanner version 4.54.6 with clamav 0.88.6 Budi Febrianto From r.berber at computer.org Fri Dec 1 06:16:33 2006 From: r.berber at computer.org (=?ISO-8859-1?Q?Ren=E9_Berber?=) Date: Fri Dec 1 06:18:26 2006 Subject: Viruses being blocked by filename rules, not being picked up by ClamAV In-Reply-To: <200612010535.kB15ZdbF013064@summitmotors.com.au> References: <200612010535.kB15ZdbF013064@summitmotors.com.au> Message-ID: Jon Bates wrote: [snip] > Current ClamAV version is 0.88.6. > > Log shows: > > Dec 1 16:31:43 MailScanner[28665]: New Batch: Found 2 messages waiting > Dec 1 16:31:43 MailScanner[28665]: New Batch: Scanning 1 messages, 10461 > bytes > Dec 1 16:31:44 MailScanner[28515]: Virus and Content Scanning: Starting > > ... so I assume this means that it's working? Yes, it means that MS is going through the virus scan phase. > > Option: Virus Scanners = clamav Have you tried changing this into "Virus Scanners = clamavmodule". This change means something different of what you are using, option clamav uses the lib/clamav-wrapper, clamavmodule uses the perl module (which you may, or may not have installed -- `cpan -D Mail::ClamAV` will show if it is installed). Or using the option as you have it, check virus.scanners.conf to see if the corresponding line is correct. Also, if you changed the wrapper, see what is being executed (clamscan or clamdscan) and what options are used (with clamscan the options are passed as parameters, with clamdscan the options are in /etc/clamd.conf). If using clamdscan, see if clamd is running. -- Ren? Berber From taz at taz-mania.com Fri Dec 1 06:50:14 2006 From: taz at taz-mania.com (Dennis Willson) Date: Fri Dec 1 06:50:22 2006 Subject: OT: Alpha of Milter-Spamtrap Message-ID: <456FD0A6.4020005@taz-mania.com> I put an alpha version of milter-spamtrap up on sourceforge. http://sourceforge.net/projects/milter-spamtrap I will do more testing this weekend and upload a new version. If anyone wants to download it and look it over that would be great. I am also looking for some input on something. Originally, I had thought you would have a choice as to only save the IP addresses in a file or use the MySQL database or both. However, when I think back to when I did my dedicated spamtrap I hit about 1 million entries in a relatively short time. I think that is way too many for text files. I think I should keep the text files only for debug purposes, I think it would be un-workable to have it read in a million IP addresses from a text file on startup to do the blocking. Features: - external editable text configuration file; - whitelists by an IP address (CIDR notation) - blocks servers that have previously sent Spam - fast in-memory cache of blacklisted servers - cache entries time-out after an hour so if they have been removed from the database they will go away. If milter-spamtrap receives another Spam from the same server, it will find it in the database and place it in the cache for another hour (only works with MySQL database support) - optional MySQL database of blacklisted servers - optional saving of Spam headers and/or body to show what caused the offending server to be placed on the blacklist - optional cron job to convert database entries to a BIND DNSBL zone file so you can share your blacklist with others - ability to mark an IP address as 'inactive' but not lose the listing so that a history can be maintained (only available when logging to a MySQL database) - ability to have one or more individual email addresses defined as honeypots - ability to have one or more whole domains defined as honeypots - optional extensive debug logging From dhawal at netmagicsolutions.com Fri Dec 1 09:03:51 2006 From: dhawal at netmagicsolutions.com (Dhawal Doshy) Date: Fri Dec 1 09:04:05 2006 Subject: Block Backscatter Mails? In-Reply-To: <456F2854.70501@net-com.de> References: <456F1B6F.2090509@net-com.de> <456F231D.3020509@fsl.com> <456F2854.70501@net-com.de> Message-ID: <456FEFF7.1010003@netmagicsolutions.com> Matthias Kellermann wrote: > Hi Steve, > > Steve Freegard schrieb: >> Hi Matthias, >> >> If you are using Sendmail - check out milter-null: >> http://www.snertsoft.com/sendmail/milter-null/ >> >> Cheers, >> Steve. > Thanks for your answer. > > I'm using Postfix so I don't think I can use milter-null, can I? > > Are there other plugins I could use? > > Best Regards, > Matthias postfix > 2.3 supports the milter specification.. also read this http://www.postfix.org/BACKSCATTER_README.html AND search the postfix archives. - dhawal From vinay_poojary2000 at yahoo.co.in Fri Dec 1 09:14:01 2006 From: vinay_poojary2000 at yahoo.co.in (vinay poojary) Date: Fri Dec 1 09:14:12 2006 Subject: thks for the mailscanner tool Message-ID: <58837.36610.qm@web8313.mail.in.yahoo.com> Dear Sir, I am using mailscanner with sendmail.The sendmail is installed with smtp-auth .I have no such problems with mailscanner .I am just enjoying the mailscanner configuration . But presently i am facing the problem of addres spoofing .The people in my own company can change the from address and send mail to anyone via smtp auth .Is there any way i could stop these address spoofing . Thks in advance . Regards, vinay poojary --------------------------------- Find out what India is talking about on - Yahoo! Answers India Send FREE SMS to your friend's mobile from Yahoo! Messenger Version 8. Get it NOW -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20061201/c6ef7cf8/attachment.html From dhawal at netmagicsolutions.com Fri Dec 1 09:22:28 2006 From: dhawal at netmagicsolutions.com (Dhawal Doshy) Date: Fri Dec 1 09:22:48 2006 Subject: thks for the mailscanner tool In-Reply-To: <58837.36610.qm@web8313.mail.in.yahoo.com> References: <58837.36610.qm@web8313.mail.in.yahoo.com> Message-ID: <456FF454.7050508@netmagicsolutions.com> vinay poojary wrote: > Dear Sir, > > I am using mailscanner with sendmail.The sendmail is installed with > smtp-auth .I have no such problems with mailscanner .I am just enjoying > the mailscanner configuration . > > But presently i am facing the problem of addres spoofing .The people in > my own company can change the from address and send mail to anyone via > smtp auth .Is there any way i could stop these address spoofing . This totally depends on your MTA (mailscanner comes much later in the picture).. for instance postfix can do this using reject_sender_login_mismatch (qmail can do this as well with an addon patch). Don't know about sendmail, maybe some sendmail experts can shed some more light, - dhawal From martinh at solidstatelogic.com Fri Dec 1 09:24:27 2006 From: martinh at solidstatelogic.com (Martin Hepworth) Date: Fri Dec 1 09:24:34 2006 Subject: thks for the mailscanner tool In-Reply-To: <58837.36610.qm@web8313.mail.in.yahoo.com> References: <58837.36610.qm@web8313.mail.in.yahoo.com> Message-ID: <456FF4CB.80008@solidstatelogic.com> vinay poojary wrote: > Dear Sir, > > I am using mailscanner with sendmail.The sendmail is installed with > smtp-auth .I have no such problems with mailscanner .I am just enjoying > the mailscanner configuration . > > But presently i am facing the problem of addres spoofing .The people in > my own company can change the from address and send mail to anyone via > smtp auth .Is there any way i could stop these address spoofing . > > Thks in advance . > > Regards, > vinay poojary > > Vinay 1st point of call on this is a proper Acceptable Use Policy. If they use business computers for non-work things, they go the normal disciplinary procedures, or even straight to dismissal under gross misconduct. (never under estimate the power of HR policy!). next bit depends on how the desktops are configured and how/why they can do this.. -- Martin Hepworth Senior Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** From dhawal at netmagicsolutions.com Fri Dec 1 09:34:37 2006 From: dhawal at netmagicsolutions.com (Dhawal Doshy) Date: Fri Dec 1 09:34:47 2006 Subject: thks for the mailscanner tool In-Reply-To: <456FF4CB.80008@solidstatelogic.com> References: <58837.36610.qm@web8313.mail.in.yahoo.com> <456FF4CB.80008@solidstatelogic.com> Message-ID: <456FF72D.6060202@netmagicsolutions.com> Martin Hepworth wrote: > vinay poojary wrote: >> Dear Sir, >> >> I am using mailscanner with sendmail.The sendmail is installed with >> smtp-auth .I have no such problems with mailscanner .I am just >> enjoying the mailscanner configuration . >> >> But presently i am facing the problem of addres spoofing .The people >> in my own company can change the from address and send mail to anyone >> via smtp auth .Is there any way i could stop these address spoofing . >> >> Thks in advance . >> >> Regards, >> vinay poojary > > Vinay > > 1st point of call on this is a proper Acceptable Use Policy. If they use > business computers for non-work things, they go the normal disciplinary > procedures, or even straight to dismissal under gross misconduct. (never > under estimate the power of HR policy!). i agree that this can taken up at a different level (read as catbert), i also think that poor passwords are also responsible for sender spoofing. We had a case a year back, where a "secure" SMTP server was used for UBE (via a korean IP), using authentication that was quite easy to guess (password = username). Now we now enforce stricter passwords ;-) - dhawal From john at tradoc.fr Fri Dec 1 09:40:44 2006 From: john at tradoc.fr (John Wilcock) Date: Fri Dec 1 09:40:54 2006 Subject: Heads up: New versions of F-Prot Antivirus for all UNIX platforms Message-ID: <456FF89C.1010206@tradoc.fr> FRISK Software has released versions 4.6.7 of F-Prot Antivirus for all UNIX platforms. These newest versions of F-Prot Antivirus for UNIX provide important bugfixes and fix a previously reported security flaw. ... John. -- -- Over 3000 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr From ljosnet at gmail.com Fri Dec 1 10:57:19 2006 From: ljosnet at gmail.com (emm1) Date: Fri Dec 1 10:57:22 2006 Subject: Blocking e-mail with special characters in username Message-ID: <910ee2ac0612010257m2936e7b3ie55c0d8f1535f4d6@mail.gmail.com> I have been having alot of e-mails like this one from=. How can I block e-mail that contain characters like ' in the username/domain field? Thanks! From martinh at solidstatelogic.com Fri Dec 1 11:06:06 2006 From: martinh at solidstatelogic.com (Martin Hepworth) Date: Fri Dec 1 11:06:58 2006 Subject: Blocking e-mail with special characters in username In-Reply-To: <910ee2ac0612010257m2936e7b3ie55c0d8f1535f4d6@mail.gmail.com> References: <910ee2ac0612010257m2936e7b3ie55c0d8f1535f4d6@mail.gmail.com> Message-ID: <45700C9E.8020902@solidstatelogic.com> emm1 wrote: > I have been having alot of e-mails like this one > from=. How can I block e-mail that > contain characters like ' in the username/domain field? > > Thanks! best to look at what SA you've got. Can you pastbin an example email with full headers etc and I can run it over my system to get an idea of what my compresive system will fire.. -- Martin Hepworth Senior Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** From ljosnet at gmail.com Fri Dec 1 11:34:21 2006 From: ljosnet at gmail.com (emm1) Date: Fri Dec 1 11:34:24 2006 Subject: Blocking e-mail with special characters in username In-Reply-To: <45700C9E.8020902@solidstatelogic.com> References: <910ee2ac0612010257m2936e7b3ie55c0d8f1535f4d6@mail.gmail.com> <45700C9E.8020902@solidstatelogic.com> Message-ID: <910ee2ac0612010334n24e10e61i15461db56ada9a45@mail.gmail.com> Unfortunately I can't see because this server is a mail gateway relay'ing to another server I have no access to. I was looking for a way to block this at MTA level if possible. On 12/1/06, Martin Hepworth wrote: > emm1 wrote: > > I have been having alot of e-mails like this one > > from=. How can I block e-mail that > > contain characters like ' in the username/domain field? > > > > Thanks! > best to look at what SA you've got. > > Can you pastbin an example email with full headers etc and I can run it > over my system to get an idea of what my compresive system will fire.. > > -- > Martin Hepworth > Senior Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > From john at tradoc.fr Fri Dec 1 11:37:16 2006 From: john at tradoc.fr (John Wilcock) Date: Fri Dec 1 11:37:21 2006 Subject: Blocking e-mail with special characters in username In-Reply-To: <910ee2ac0612010257m2936e7b3ie55c0d8f1535f4d6@mail.gmail.com> References: <910ee2ac0612010257m2936e7b3ie55c0d8f1535f4d6@mail.gmail.com> Message-ID: <457013EC.9060504@tradoc.fr> emm1 wrote: > I have been having alot of e-mails like this one > from=. How can I block e-mail that > contain characters like ' in the username/domain field? > > Thanks! I've been seeing a few of these, but all have scored well over 10 points largely thanks to SARE stocks rules. If you want a specific rule, this should catch them: header local_FROM_APOSTROPHE From =~ /\<\w[\w']{1,30}\@/ John. -- -- Over 3000 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr From dean.plant at roke.co.uk Fri Dec 1 12:01:30 2006 From: dean.plant at roke.co.uk (Plant, Dean) Date: Fri Dec 1 12:02:33 2006 Subject: Can anyone tell me what this is? Message-ID: <2181C5F19DD0254692452BFF3EAF1D6802671B51@rsys005a.comm.ad.roke.co.uk> We have some messages from a customer that are being disarmed due to a whole load of scripting in the message. I know I can turn disarming off but I would like to know what this code is and what it is doing, has anyone come across code like this before? Sample data from the message source below. The whole source is here http://deanplant.bulldoghome.com/pages/deanplant%5Fbulldoghome%5Fcom/mai l.txt Thanks Dean