UNKNOWN CLAMD RETURN

[Julian Field]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Rick Cooper wrote:
>  
>
>  > -----Original Message-----
>  > From: mailscanner-bounces at lists.mailscanner.info 
>  > [mailto:mailscanner-bounces at lists.mailscanner.info] On 
>  > Behalf Of UxBoD
>  > Sent: Thursday, July 19, 2007 9:36 AM
>  > To: MailScanner discussion
>  > Subject: Re: UNKNOWN CLAMD RETURN
>  > 
>  > Not sure on that Rick as we do not use the reports.  In 
>  > MailWatch it shows as :-
>  > 
>  > Clamd: message.header was infected: 
>  > Email.Hdr.Sanesecurity.07061900 FOUND
>  > 
>  > so message.header could be changed to the word SPAM.
>
>
> Do you know what happens to the message? The reason I ask is I can't
> remember what MailScanner does to the message when it cannot find
> $infections->{"$id"}{"$part"} in it's list of associated files (or safnames
> I think).
To add a report for the entire message, set $part to "". So if you add a 
virus report for the whole message, then the whole message will be 
treated as infected. Whether adding this will require a slight change to 
MailWatch, I don't know. But that's the right way to do it. Very 
dangerous to add a report for an attachment filename that doesn't exist!

>  It may pass the message untouched and it may remove the entire
> body I just cannot remember what the reflex would be in this situation.
> Perhaps Julian can answer that. MailWatch is just looking for something to
> match the regex in functions.php (IIRC) but MailScanner may end up
> delivering the message and I need to make sure that doesn't happen.
>   

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules at Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk


-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.2 (Build 2014)
Charset: ISO-8859-1

wj8DBQFGn6mLEfZZRxQVtlQRAhnpAJ9xtZT09+61Qcj1nuTUY3Vs0k9XIQCbBGpc
blwTAMR0LVFvPtyU97LlbsQ=
=hKZa
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk