New service - the Team Cymru Malware Hash Registry!

[Steve Freegard]

--[ UxBoD ]-- wrote:
> Hmmm ... Does it scan the entire message or just if it has a attachment ?

It's using the generic virus scanner interface - so it will see the 
msg-nnnnn-n.txt and msg-nnnnnn-n.html files which relate to the 
text/plain and test/html parts of the message as exploded by the MIME 
parser which is the same as all the other virus scanners, so it will 
hash these and do a look-up for these as well.

I've just added a new attachments_only variable that is default on along 
with a bit more logging.  It's attached ;-)

Cheers,
Steve.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: generic_hash_scanner.pl
Type: application/x-perl
Size: 3138 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20081028/5962b8a3/generic_hash_scanner.bin