UNKNOWN CLAMD RETURN

[Rick Cooper]

  _____  

From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of UxBoD
Sent: Thursday, July 19, 2007 9:03 AM
To: MailScanner discussion
Subject: Re: UNKNOWN CLAMD RETURN


Hi Rick,

I changed the code too :-

      my ($dot,$childname,$filename,$rest) = split('/',$results);
      if ($filename =~ /.+?\sFOUND$/ && $rest eq '') {
         $rest = $filename;
         $childname =~ s/\.header//;
         $filename = "message.header";
       }

and it now detects okay, including in MailWatch :D
[Rick Cooper] 
 
What is in the postmaster and user reports ? 
If the  'message.header   shows up then perhaps it would work as $filename =
"SPAM". 

Rick
 


Rank	 Virus	 Percentage of detection	
1	 Html.Loan.Gen006.Sanesecurity.06120200	 
 	  43%	
2	 Html.Phishing.Bank.Rockv2Gen14.Sanesecurity.07060400	 
 	  37%	
3	 Email.Stk.Gen596.Sanesecurity.07071900.pdf	 
 	  11%	
4	 Html.Img.Gen013.Sanesecurity.06112900	 
 	  2%	
5	 Email.Hdr.Sanesecurity.07061900	 
 	  2%	
6	 Html.Phishing.Bank.Rockv2Gen28.Sanesecurity.07061800	 
 	  2%	
7	 Email.Stk.Gen591.Sanesecurity.07071800.pdf	 
 	  2%	
8	 Worm.Somefool.AR	 
 	  2%	




----- Original Message -----
From: "Rick Cooper" <rcooper at dwford.com>
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Sent: Thursday, July 19, 2007 1:56:10 PM (GMT) Europe/London
Subject: RE: UNKNOWN CLAMD RETURN

 

 > -----Original Message-----
 > From: mailscanner-bounces at lists.mailscanner.info 
 > [mailto:mailscanner-bounces at lists.mailscanner.info] On 
 > Behalf Of Rick Cooper
 > Sent: Thursday, July 19, 2007 8:51 AM
 > To: 'MailScanner discussion'
 > Subject: RE: UNKNOWN CLAMD RETURN
 > 
 >  
 > 
 >  > -----Original Message-----
 >  > From: mailscanner-bounces at lists.mailscanner.info 
 >  > [mailto:mailscanner-bounces at lists.mailscanner.info] On 
 >  > Behalf Of UxBoD
 >  > Sent: Thursday, July 19, 2007 8:33 AM
 >  > To: MailScanner discussion
 >  > Subject: Re: UNKNOWN CLAMD RETURN
 >  > 
 >  > Rick,
 >  > 
 >  > That is the problem as it does not get flagged by MailWatch 
 >  > as a Virus, which I believe just grabs the whole line from 
 >  > MailScanner.
 >  > 
 > [...]
 > 
 > I really wish I had that message |->(
 > 
 > Try this:
 > 
 >       if ($filename =~ /.+?\sFOUND$/ && $childname =~ 
 > /^.+\.header$) {
 >         $rest = $filename;
 >                 $filename = $childname;
 >                 $childname =~ s/(.+)\.header$/$1/;
 >       }
 > 

[...]

Doh! Of course the first line should be:

if ($filename =~ /.+?\sFOUND$/ && $childname =~  /^.+\.header$/) {

Forgot the last '/' in "$childname =~  /^.+\.header$/" sorry

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


-- 
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


-- 
This message has been scanned for viruses and 
dangerous content by  <http://www.mailscanner.info/> MailScanner, and is 
believed to be clean. 
-- 
This message has been scanned for viruses and 
dangerous content by  <http://www.mailscanner.info/> MailScanner, and is 
believed to be clean. 


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070719/c322a1e0/attachment-0001.html