MailScanner ANNOUNCE: Version 4.62.9 released (UNCLASSIFIED)

[Julian Field]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

The option only has an effect if you run at least ClamAV in some form.

Kash, Howard (Civ, ARL/CISD) wrote:
> Classification:  UNCLASSIFIED 
> Caveats: NONE
>
>  
> I'm wondering if this "side effect" works if you only use McAfee - or
> does it only work if you happen to also use ClamAV?  If the latter, I
> would like to request it be made to work for McAfee as well.  I enabled
> this setting this morning, but have not yet seen any McAfee logs
> referring to .message files.
>
> Thanks,
> Howard
>
>
> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info
> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Glenn
> Steen
> Sent: Thursday, August 02, 2007 3:46 AM
> To: MailScanner discussion
> Subject: Re: MailScanner ANNOUNCE: Version 4.62.9 released
>
> On 31/07/07, Julian Field <MailScanner at ecs.soton.ac.uk> wrote:
>   
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> I have just released a new version of MailScanner, 4.62.9. I don't
>>     
> (snip)
>   
>> - --- New "ClamAV Full Message Scan" setting, and improvements to the
>> ClamAV parser so that the SANESecurity phishing- and spam-detection
>> signatures can be reliably used. Note this new setting is disabled by
>> default, as it has a slight speed impact.
>>     
> (snip)
>
> Enabling this setting isn't only beneficial for ClamAV, but also for
> McAfee ... Note the McAfee line in this report snippet:
> -----
>    Subject: You've received a postcard from a Friend!
>  MessageID: D6DC4E452.39523
> Quarantine: /var/spool/MailScanner/quarantine/20070801/D6DC4E452.39523
>     Report: ClamAV Module:  message was infected: Email.Phishing.RB-1221
>             McAfee: /D6DC4E452.39523.message        Found the
> W32/Zhelatin.gen!eml virus !!!
> -----
> As you can see, it isn't just ClamAV phishing signatures triggering on
> the "complete message" file... Pretty cool side effect:-).
>
> Perhaps makes the name ... less than intuitive:-):-). But since I'll
> want this and always use ClamAV, it's OK by me... Otherwise it'd have
> to be "Antivirus Full Message Scan" or something similar:-).
>
> Cheers
>   

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules at Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk


-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.2 (Build 2014)
Charset: ISO-8859-1

wj8DBQFGsiXYEfZZRxQVtlQRAhf1AKD81uoYl5HXQ3VbXcMJKV0xLqmyNQCfSQ0a
v1Uu5hZaERX9yfexO51LMUI=
=1vFY
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk