Logwatch file being tagged as a virus file and deleted

Howard Fleming hfleming at moosebird.net
Thu Feb 28 19:15:25 GMT 2008

Mark Sapiro wrote:
> Howard Fleming wrote:
>> Is there any way to exclude a email address from being scanned for 
>> viruses?  For the last 3 days my logwatch file from my mail server has 
>> been deleted, and I get the following:
>>     Sender: root at messenger.mideasti.org
>> IP Address:
>>  Recipient: hfleming at mideasti.org
>>    Subject: LogWatch for messenger.mideasti.org
>>  MessageID: F254D540E8.78B90
>> Quarantine:
>>     Report: Clamd:  message was infected: Email.Phishing.DblDom-39 FOUND
>> I have added root at messenger.mideasti.org to phishing.safe.sites.conf, 
>> but it did not make any difference (or is this the right place?).
> I had the same issue when I first installed Mailscanner. My solution is
> to put
> Scan Messages = %rules-dir%/scan.messages.rules
> in MailScanner.conf and then put
> From: no
> FromOrTo: default yes
> in scan.messages.rules. You may not want to exempt all mail originating
> from localhost, so you may want a more restrictive rule.

Hi Mark,

I added the change, only change I made to the contents of 
scan.messages.rules was to change

From: no


From: root at messenger.mideasti.org no

Will know more tomorrow... :o)


More information about the MailScanner mailing list