Re: Virus Scan Thoughts

From: Mark Janssen (
Date: Sat 22 May 2004 - 14:57:56 GMT

  • Next message: Josh Berry: "Re: Adding ClamAV"

    Samuel wrote:

    > My issue with adding a unique code to the save and drop, is that I also
    > drop certain types of attachments and want to alert the user that those
    > attachments are prohibited. Right now, I see no way to add an indicator
    > to the message or have a seperate virus specific message that could be
    > looked for via procmail when it is a virus.
    > Samuel
    > Mark Janssen wrote:
    >>Samuel wrote:
    >>>I know an idea was brought up about doing a header info, and it was
    >>>shown that you can not do that in a stream, however, it would be nice
    >>>if data returned from the virus scanning script could be embedded in a
    >>>message (add a few more variables that are parsed).
    >>>My thought is things like the anomy-filescan-result data. This way the
    >>>virus found could be inserted, and if someone wished, a unique code
    >>>could be done to allow easier parsing, without messing up a normal
    >>>drop message.
    >>>Another thought is to add a VIRUS message type, functions as a drop
    >>>but with virus specific as attachments can be dropped for other
    >>>reasons (just not valid types, not always a virus).
    >>What I did was adding a unique code to the msg_file_save and
    >>msg_file_drop messages. This code is then seen by procmail, and procmail
    >>then trashes the emails (I use it because some of my users get mass
    >>mailed by virii).
    >>I must say adding a header with the virus name is a nice idea (even
    >>including the virus name in the msg_file_* messages would be good). The
    >>header might be a problem because of Anomy's structure but I think
    >>placing the virusscan output in msg_file_* could be done without too
    >>many problems.
    >>Mark Janssen

    I drop virii, and I save exe, scr, etc. files. As you can set a seperate
    message/ID for drop and save, it works perfectly.

    Mark Janssen

    hosted by