Announcement: New beta 4.59.2 released

Julian Field MailScanner at
Fri Apr 27 18:11:02 IST 2007

Hash: SHA1

Juan Pablo Salazar Bertín wrote:
> Julian Field <MailScanner <at>> writes:
>> Hi folks,
>> I have just released a new beta 4.59.2 which includes the support for 
>> clamd, using the patches provided earlier on this list.
>> If you use clamd and are running MailScanner as root (or have not 
>> specified the Run As User at all), then it is vital that you read the 
>> notes just above the "Incoming Work Group" setting in order to get the 
>> ownership and permissions correct so that clamd can read them.
>> Download as usual from
>> Please test this release for me!
>> The Change Log for 4.59 so far is this:
>> * New Features and Improvements *
>> 2 Changed locations monitored for ClamAV updates to fit new ClamAV 0.9 
>> layout.
>> 2 Added support for clamdscan and clamd. Use "Virus Scanners = clamd".
>> * Fixes *
>> 1 Exim fix by Debian Maintainer: Simon Walter.
>> 1 Incoming Work Group not honoured for files with a leading dot in their
>>   filename. Again, fix by Simon Walter.
>> Jules
> Hi Julian, I've been trying to find out why some phishing is being undetected by
> MailScanner. I think it's due to line 5581 in I'm receiving phishing
> like this:
> <a href=><font
> color=blue font size=4><u>
> So, as they're not using double quotes, MailScanner thinks it's an empty A tag.
> I think a better way of guessing if it's an empty A tag would be to check if
> href is empty, something like replacing:
>  $DisarmInsideLink = 0 if $text =~ /\/\>$/; # JKF Catch /> empty A tags
> with:
>  $DisarmInsideLink = 0 if $DisarmLinkURL eq ''; # JPSB empty A tags
> I've tested this in a development box against some phishing and it works. I'd
> like you to tell us if this change doesn't have any drawback, so we can safely
> patch production servers, and may be it's included in this new version. Thanks.
> PS: You can get a sample phishing message at
I have added your patch and it will be in the next release.
I would be most grateful if other people could test this patch as well!


- -- 
Julian Field MEng CITP
Buy the MailScanner book at

MailScanner customisation, or any advanced system administration help?
Contact me at Jules at Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit

Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1


This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit

More information about the MailScanner mailing list