<div dir="ltr">OK everyone I also changed the option<br><br><br>Quarantine Silent Virus = yes<br><br><br>I will test and post results here in the list<br><br><br><br><br><div class="gmail_quote">On Mon, Nov 23, 2009 at 8:53 AM, Monis Monther <span dir="ltr"><<a href="mailto:mmmm82@gmail.com">mmmm82@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div dir="ltr">Dear Julian , Thanks for your reply, I read about what you proposed and did the following<br>
<br>1- Under MailScanner.conf<br>Still deliver silent viruses = yes<br><br>and I removed the eicar from the nonforgering virus list <br>
<br>2- Restart the MailScanner service<br><br>I sent the eicar virus and in the log I got this<br><br>Silent: Delivered 1 messages containing silent viruses<br><br><br>Still I did not get the message I only go the attachment that says <br>
<br>The original e-mail attachment "the entire message"<br>was believed to be dangerous and/or infected by a virus and has been<br>replaced by this warning message.<br><br>Due to limitations placed on us by the Regulation of Investigatory Powers<br>
Act 2000, we were unable to keep a copy of the infected attachment. Please<br>ask the sender of the message to disinfect their original version and send<br>you a clean copy.<br><br><br><br>My Goal is that if someone sent a message that contained a virus, the virus should be quarantined/deleted , but the message should reach its recipient with the subject changed to virus and the warning attachment sent with it, the last two I am achieving but the first I am failing at.Thanks. <br>
<div><div></div><div class="h5">
<br><br><div class="gmail_quote">On Sun, Nov 22, 2009 at 2:15 PM, Jules Field <span dir="ltr"><<a href="mailto:MailScanner@ecs.soton.ac.uk" target="_blank">MailScanner@ecs.soton.ac.uk</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
If it's being treated as a "Silent Virus" then it won't be stored in the quarantine. Read about "Silent Viruses" and "Non-Forging Viruses" in MailScanner.conf.<div><br>
<br>
On 22/11/2009 10:26, Monis Monther wrote:<br>
</div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div>
> I have the clamavmodule and its working fine<br>
<br>
How do you know this?<br>
<br>
<br>
I knew because I see in the logs that it is catching stuff<br>
<br>
<br>
Try sending an email through the machine with the EICAR attachment<br>
(<a href="http://www.eicar.org/anti_virus_test_file.htm" target="_blank">http://www.eicar.org/anti_virus_test_file.htm</a>), and check:<br>
<br>
I tried the test , thanks for the link<br>
<br>
a) the mail system logs, to see whether MailScanner thinks it's detected a<br>
virus<br>
<br>
In the log , it found it and gave this<br>
<br>
Virus and Content Scanning: Starting<br>
ClamAVModule::INFECTED:: Eicar-Test-Signature:: ./A32B56E03A2.E8204/<br></div>
ClamAVModule::INFECTED:: Eicar-Test-Signature:: ./A32B56E03A2.E8204/<a href="http://eicar.com" target="_blank">eicar.com</a> <<a href="http://eicar.com" target="_blank">http://eicar.com</a>><div><br>
....<br>
.....<br>
Requeue: A32B56E03A2.E8204 to E19D26E009C<br>
....<br>
....<br>
Cleaned: Delivered 1 cleaned messages<br>
<br>
<br>
b) the headers of the (presumably) received message, to see whether it tells<br>
you that anti-virus scanning was performed (X-OrganisationName-<br>
<br>
Viruscheck)<br>
<br>
I only had these headers<br>
X-MyDomain-MailScanner-ID: AA32E6E03B9.9919A<br>
X-MyDomain-MailScanner: Found to be infected<br>
X-MyDomain-MailScanner-SpamScore: ss<br></div>
X-MyDomain-MailScanner-From: <a href="mailto:monis.monther@mediaintl.net" target="_blank">monis.monther@mediaintl.net</a> <mailto:<a href="mailto:monis.monther@mediaintl.net" target="_blank">monis.monther@mediaintl.net</a>><div>
<br>
X-Spam-Status: No<br>
X-RCPT-TO: <someone><br>
Status: U<br>
X-UIDL: 548082981<br>
<br>
So I conclude that it was not detected as spam but as infected , and I got the notification attachment delivered saying call help desk... bal bla<br>
<br>
But the attachment was not saved under quarantine, I want the attachments to be saved.<br>
<br>
c) the output of /path/to/MailScanner --lint (to see whether it<br>
thinks the<br>
antivirus engine is correctly installed and available)<br>
<br>
<br>
It showed that I have clamavmodule successfully installed<br>
<br>
<br>
<br>
Conclusion: I was mistakes when I thought it was related to spam score, but now I want the virus attachment to be stored in quarantine not deleted, Thanks<br>
<br>
<br>
<br>
<br>
<br></div><div><div></div><div>
On Thu, Nov 19, 2009 at 2:26 PM, Antony Stone <<a href="mailto:Antony.Stone@mailscanner.open.source.it" target="_blank">Antony.Stone@mailscanner.open.source.it</a> <mailto:<a href="mailto:Antony.Stone@mailscanner.open.source.it" target="_blank">Antony.Stone@mailscanner.open.source.it</a>>> wrote:<br>
<br>
On Thursday 19 November 2009, Monis Monther wrote:<br>
<br>
> I have the following<br>
><br>
> Virus Scanning = yes<br>
> Virus Scanners = clamavmodule<br>
> Deliver Disinfected Files = no<br>
> Silent Viruses = HTML-IFrame All-Viruses<br>
> Still Deliver Silent Viruses = no<br>
><br>
> I have the clamavmodule and its working fine<br>
<br>
How do you know this?<br>
<br>
> and when I set HighScore spam = store it started to quarantine<br>
virus that<br>
> get a high score spam and still delivers viruses that come with<br>
low spam<br>
> messages<br>
<br>
Are you saying that the quarantined messages (quarantined because<br>
they are<br>
detected as spam) still contain the virus attachments, or have<br>
these been<br>
cleaned?<br>
<br>
Try sending an email through the machine with the EICAR attachment<br>
(<a href="http://www.eicar.org/anti_virus_test_file.htm" target="_blank">http://www.eicar.org/anti_virus_test_file.htm</a>), and check:<br>
<br>
a) the mail system logs, to see whether MailScanner thinks it's<br>
detected a<br>
virus<br>
<br>
b) the headers of the (presumably) received message, to see<br>
whether it tells<br>
you that anti-virus scanning was performed<br>
(X-OrganisationName-Viruscheck)<br>
<br>
c) the output of /path/to/MailScanner --lint (to see whether it<br>
thinks the<br>
antivirus engine is correctly installed and available)<br>
<br>
<br>
Antony.<br>
<br>
--<br>
"Reports that say that something hasn't happened are always<br>
interesting to me,<br>
because as we know, there are known knowns; there are things we<br>
know we know.<br>
We also know there are known unknowns; that is to say we know<br>
there are some<br>
things we do not know. But there are also unknown unknowns - the<br>
ones we<br>
don't know we don't know."<br>
<br>
- Donald Rumsfeld, US Secretary of Defence<br>
<br>
Please reply<br>
to the list;<br>
please<br>
don't CC me.<br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br></div></div>
<mailto:<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a>><div><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
<br>
<br>
</div></blockquote>
<br>
Jules<br>
<br>
-- <br>
Julian Field MEng CITP CEng<br>
<a href="http://www.MailScanner.info" target="_blank">www.MailScanner.info</a><br>
Buy the MailScanner book at <a href="http://www.MailScanner.info/store" target="_blank">www.MailScanner.info/store</a><br>
<br>
Need help customising MailScanner?<br>
Contact me!<br>
Need help fixing or optimising your systems?<br>
Contact me!<br>
Need help getting you started solving new requirements from your boss?<br>
Contact me!<br>
<br>
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654<br>
Follow me at <a href="http://twitter.com/JulesFM" target="_blank">twitter.com/JulesFM</a> and <a href="http://twitter.com/MailScanner" target="_blank">twitter.com/MailScanner</a><br>
<br>
<br>
-- <br>
This message has been scanned for viruses and<br>
dangerous content by MailScanner, and is<br>
believed to be clean.<br><font color="#888888">
<br>
-- <br></font><div><div></div><div>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website! <br>
</div></div></blockquote></div><br></div></div></div>
</blockquote></div><br></div>