Malformed signature kills MailScanner

Alvaro Marin alvaro at hostalia.com
Tue Mar 15 11:56:27 GMT 2011


Hi,

El 14/03/11 18:55, Scott Silva escribió:
> on 3/14/2011 10:39 AM Jeff Earickson spake the following:
>> All (And Julian),
>>
>> I am willing to bet that this bug is what has been biting us who have
>> been sending emails
>> with the subject "Making attempt # at processing message".  It smells
>> similar.  Thanks for the
>> debugging effort; I didn't have much to go on.
>>
>> Jeff Earickson
>> Colby College
>
> Have to see if Jules chimes in on this one... Or Glenn... Any of the more
> proficient perl coders...
>

I see that there are spaces in some signature names of some Sanesecurity 
archives (doppelstern.hdb, winnow.attachments.hdb, 
winnow_malware.hdb...), so I've added this line:

$virusname =~ s/ //;

after the split (line 1624 of SweepViruses.pm) :

($keyword, $virusname, $filename) = split(/:: /, $line, 3);

to delete spaces in the name of the virus.
Perhaps there is a better place to do it, but it works fine for me.

Regards,

-- 
Alvaro Marín Illera
Hostalia Internet
www.hostalia.com



More information about the MailScanner mailing list