Malformed signature kills MailScanner
alvaro at hostalia.com
Tue Mar 15 11:56:27 GMT 2011
El 14/03/11 18:55, Scott Silva escribió:
> on 3/14/2011 10:39 AM Jeff Earickson spake the following:
>> All (And Julian),
>> I am willing to bet that this bug is what has been biting us who have
>> been sending emails
>> with the subject "Making attempt # at processing message". It smells
>> similar. Thanks for the
>> debugging effort; I didn't have much to go on.
>> Jeff Earickson
>> Colby College
> Have to see if Jules chimes in on this one... Or Glenn... Any of the more
> proficient perl coders...
I see that there are spaces in some signature names of some Sanesecurity
archives (doppelstern.hdb, winnow.attachments.hdb,
winnow_malware.hdb...), so I've added this line:
$virusname =~ s/ //;
after the split (line 1624 of SweepViruses.pm) :
($keyword, $virusname, $filename) = split(/:: /, $line, 3);
to delete spaces in the name of the virus.
Perhaps there is a better place to do it, but it works fine for me.
Alvaro Marín Illera
More information about the MailScanner