UNKNOWN CLAMD RETURN

Julian Field MailScanner at ecs.soton.ac.uk
Thu Jul 19 19:12:26 IST 2007


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Rick Cooper wrote:
>  
>
>  > -----Original Message-----
>  > From: mailscanner-bounces at lists.mailscanner.info 
>  > [mailto:mailscanner-bounces at lists.mailscanner.info] On 
>  > Behalf Of UxBoD
>  > Sent: Thursday, July 19, 2007 9:36 AM
>  > To: MailScanner discussion
>  > Subject: Re: UNKNOWN CLAMD RETURN
>  > 
>  > Not sure on that Rick as we do not use the reports.  In 
>  > MailWatch it shows as :-
>  > 
>  > Clamd: message.header was infected: 
>  > Email.Hdr.Sanesecurity.07061900 FOUND
>  > 
>  > so message.header could be changed to the word SPAM.
>
>
> Do you know what happens to the message? The reason I ask is I can't
> remember what MailScanner does to the message when it cannot find
> $infections->{"$id"}{"$part"} in it's list of associated files (or safnames
> I think).
To add a report for the entire message, set $part to "". So if you add a 
virus report for the whole message, then the whole message will be 
treated as infected. Whether adding this will require a slight change to 
MailWatch, I don't know. But that's the right way to do it. Very 
dangerous to add a report for an attachment filename that doesn't exist!

>  It may pass the message untouched and it may remove the entire
> body I just cannot remember what the reflex would be in this situation.
> Perhaps Julian can answer that. MailWatch is just looking for something to
> match the regex in functions.php (IIRC) but MailScanner may end up
> delivering the message and I need to make sure that doesn't happen.
>   

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules at Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk


-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.2 (Build 2014)
Charset: ISO-8859-1

wj8DBQFGn6mLEfZZRxQVtlQRAhnpAJ9xtZT09+61Qcj1nuTUY3Vs0k9XIQCbBGpc
blwTAMR0LVFvPtyU97LlbsQ=
=hKZa
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk



More information about the MailScanner mailing list