New service - the Team Cymru Malware Hash Registry!
steve.freegard at fsl.com
Tue Oct 28 16:10:52 GMT 2008
--[ UxBoD ]-- wrote:
> Hmmm ... Does it scan the entire message or just if it has a attachment ?
It's using the generic virus scanner interface - so it will see the
msg-nnnnn-n.txt and msg-nnnnnn-n.html files which relate to the
text/plain and test/html parts of the message as exploded by the MIME
parser which is the same as all the other virus scanners, so it will
hash these and do a look-up for these as well.
I've just added a new attachments_only variable that is default on along
with a bit more logging. It's attached ;-)
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 3138 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20081028/5962b8a3/generic_hash_scanner.bin
More information about the MailScanner