Logwatch file being tagged as a virus file and deleted

Mark Sapiro mark at msapiro.net
Thu Feb 28 15:01:13 GMT 2008

Howard Fleming wrote:

>Is there any way to exclude a email address from being scanned for 
>viruses?  For the last 3 days my logwatch file from my mail server has 
>been deleted, and I get the following:
>     Sender: root at messenger.mideasti.org
>IP Address:
>  Recipient: hfleming at mideasti.org
>    Subject: LogWatch for messenger.mideasti.org
>  MessageID: F254D540E8.78B90
>     Report: Clamd:  message was infected: Email.Phishing.DblDom-39 FOUND
>I have added root at messenger.mideasti.org to phishing.safe.sites.conf, 
>but it did not make any difference (or is this the right place?).

I had the same issue when I first installed Mailscanner. My solution is
to put

Scan Messages = %rules-dir%/scan.messages.rules

in MailScanner.conf and then put

From: no
FromOrTo: default yes

in scan.messages.rules. You may not want to exempt all mail originating
from localhost, so you may want a more restrictive rule.

Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

More information about the MailScanner mailing list