<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi,<br>
<br>
I have a question about Clamd and MailScanner.<br>
<br>
<big>All my "Clamd INFECTED" mail are saved to my quarantine folder
as the following logs.</big><br>
<small>*Aug 14 10:07:21 10.32.33.25 MailScanner[23474]:
Clamd::INFECTED:: Sanesecurity.Junk.19693.UNOFFICIAL ::
./r7EE79MK022851/ <br>
*Aug 14 10:07:21 10.32.33.25 MailScanner[23474]: Infected message
r7EE79MK022851 came from 95.158.131.135 <br>
*Aug 14 10:07:21 10.32.33.25 MailScanner[23474]: Saved entire
message to /quarantaine/usherbrooke/20130814/r7EE79MK022851 </small><br>
<br>
<big>I received a suspicious mail and i looked at the logs. I saw
that the mail was reported INFECTED by Clamd but it was still
delivered and do not move in quarantine folder. And not placed in
the quarantine folder.</big> I would like to know witch
configuration or file permit me to change this option?<br>
<br>
<big>Thanks.</big><br>
<br>
<br>
<small>*Aug 12 19:53:11 10.32.33.25 sendmail[13327]: r7CNrB6J013327:
Milter (milter-limit): init success to negotiate <br>
*Aug 12 19:53:11 10.32.33.25 sendmail[13327]: r7CNrB6J013327:
Milter: connect to filters <br>
*Aug 12 19:53:11 10.32.33.25 sendmail[13327]: r7CNrB6J013327:
milter=milter-limit, action=connect, continue <br>
*Aug 12 19:53:22 10.32.33.25 sendmail[13327]: r7CNrB6J013327:
milter=milter-limit, action=mail, continue <br>
*Aug 12 19:53:22 10.32.33.25 sendmail[13327]: r7CNrB6J013327:
milter=milter-limit, action=rcpt, continue <br>
*Aug 12 19:53:22 10.32.33.25 sendmail[13327]: r7CNrB6J013327:
from=<a class="moz-txt-link-rfc2396E" href="mailto:info@webmaster.fr"><info@webmaster.fr></a>, size=1317, class=0, nrcpts=4,
msgid=<a class="moz-txt-link-rfc2396E" href="mailto:eb6a7c1bcc701df0e2282168a95ed257.squirrel@gaia.gi.ee"><eb6a7c1bcc701df0e2282168a95ed257.squirrel@gaia.gi.ee></a>,
bodytype=8BITMIME, proto=ESMTP, daemon=MTA, relay=gaia.gi.ee
[193.40.102.14] <br>
*Aug 12 19:53:22 10.32.33.25 sendmail[13327]: r7CNrB6J013327:
Milter accept: message <br>
*Aug 12 19:53:24 10.32.33.25 clamd[4457]:
/var/spool/MailScanner/incoming/13799/r7CNrB6J013327.header:
ScamNailer.Phish.info_AT_webmaster.fr.UNOFFICIAL FOUND <br>
*Aug 12 19:53:24 10.32.33.25 clamd[4457]:
/var/spool/MailScanner/incoming/13799/r7CNrB6J013327.message:
ScamNailer.Phish.info_AT_webmaster.fr.UNOFFICIAL FOUND <br>
*Aug 12 19:53:24 10.32.33.25 MailScanner[13799]: <font
color="#cc0000"><big><b>Clamd::INFECTED::
ScamNailer.Phish.info_AT_webmaster.fr.UNOFFICIAL</b></big></font>
:: ./r7CNrB6J013327/ <br>
*Aug 12 19:53:24 10.32.33.25 MailScanner[13799]: Found spam-virus
ScamNailer.Phish.info_AT_webmaster.fr.UNOFFICIAL in
r7CNrB6J013327 <br>
*Aug 12 19:53:24 10.32.33.25 MailScanner[13799]: Found spam-virus
ScamNailer.Phish.info_AT_webmaster.fr.UNOFFICIAL in
r7CNrB6J013327 <br>
*Aug 12 19:53:33 10.32.33.25 MailScanner[13799]: Message
r7CNrB6J013327 from 193.40.102.14 (<a class="moz-txt-link-abbreviated" href="mailto:info@webmaster.fr">info@webmaster.fr</a>) to
usherbrooke.ca is n'est pas un polluriel, SpamAssassin (not
cached, score=5.747, requis 6.5, BAYES_50 0.80, DCC_CHECK 1.10,
RCVD_IN_BL_SPAMCOP_NET 1.35, RCVD_IN_PSBL 1.00, RCVD_IN_UCE_PFSM_1
1.50) <br>
*Aug 12 19:53:34 10.32.33.25 sendmail[13374]: r7CNrB6J013327:
to=<a class="moz-txt-link-rfc2396E" href="mailto:mail@usherbrooke.ca"><mail@usherbrooke.ca></a>, delay=00:00:12, xdelay=00:00:00,
mailer=smtp, pri=211317, relay=[132.210.6.44] [132.210.6.44],
dsn=2.0.0, <font color="#cc0000"><big><b>stat=Sent</b></big></font>
(r7CNrXDo006114 Message accepted for delivery) </small><b><span
style="font-size: 14pt; color: black;"><br>
<br>
<br>
<br>
<br>
Jean-Francois Masson</span></b><span style="font-size: 14pt;
color: black;">, Technicien en systèmes ordinés</span><br>
<div class="moz-signature">
<p class="MsoNormal" style="page-break-after: avoid;"><i><span
style="color: black;"> Section Infrastructure des serveurs</span></i><span
style="color: black;"><br>
Service des technologies de l’information<br>
Université de Sherbrooke<br>
</span><br>
<span style="color: black;">Tél.: 819 821-8000, poste 61987</span></p>
<span style="color: black;">Courriel: </span><span style=""><a
href="mailto:Jean-Francois.Masson@USherbrooke.ca"><span
style="color: blue;">Jean-Francois.Masson@USherbrooke.ca</span></a><span
style="color: rgb(143, 143, 143);"><br>
</span></span></div>
</body>
</html>