MailScanner ANNOUNCE: Version 4.62.9 released (UNCLASSIFIED)

[Kash, Howard (Civ, ARL/CISD)]

Classification:  UNCLASSIFIED 
Caveats: NONE

 
I'm wondering if this "side effect" works if you only use McAfee - or
does it only work if you happen to also use ClamAV?  If the latter, I
would like to request it be made to work for McAfee as well.  I enabled
this setting this morning, but have not yet seen any McAfee logs
referring to .message files.

Thanks,
Howard


-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Glenn
Steen
Sent: Thursday, August 02, 2007 3:46 AM
To: MailScanner discussion
Subject: Re: MailScanner ANNOUNCE: Version 4.62.9 released

On 31/07/07, Julian Field <MailScanner at ecs.soton.ac.uk> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> I have just released a new version of MailScanner, 4.62.9. I don't
(snip)
> - --- New "ClamAV Full Message Scan" setting, and improvements to the
> ClamAV parser so that the SANESecurity phishing- and spam-detection
> signatures can be reliably used. Note this new setting is disabled by
> default, as it has a slight speed impact.
(snip)

Enabling this setting isn't only beneficial for ClamAV, but also for
McAfee ... Note the McAfee line in this report snippet:
-----
   Subject: You've received a postcard from a Friend!
 MessageID: D6DC4E452.39523
Quarantine: /var/spool/MailScanner/quarantine/20070801/D6DC4E452.39523
    Report: ClamAV Module:  message was infected: Email.Phishing.RB-1221
            McAfee: /D6DC4E452.39523.message        Found the
W32/Zhelatin.gen!eml virus !!!
-----
As you can see, it isn't just ClamAV phishing signatures triggering on
the "complete message" file... Pretty cool side effect:-).

Perhaps makes the name ... less than intuitive:-):-). But since I'll
want this and always use ClamAV, it's OK by me... Otherwise it'd have
to be "Antivirus Full Message Scan" or something similar:-).

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
-- 
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 
Classification:  UNCLASSIFIED 
Caveats: NONE