Re: [Mimedefang] clamav oddity

[Ashley M. Kirchner]

David F. Skoll wrote:

I forgot... MIMEDefang adds a "From_" line before it passes the
message to clam, to help it recognize it as an e-mail.  It won't
work without that line (which is missing from ENTIRE_MESSAGE)
   Aha, now I'm seeing the differences.  The two qdirs it successfully 
identified, both have full message headers in ENTIRE_MESSAGE:

-----
Received: from localhost (localhost)
       by relay2.germany.net (8.13.0.PreAlpha4/8.13.0.PreAlpha4) id 
i3U80hd1028058;
       Fri, 30 Apr 2004 10:00:43 +0200 (MEST)
Date: Fri, 30 Apr 2004 10:00:43 +0200 (MEST)
From: Mail Delivery Subsystem <[EMAIL PROTECTED]>
Message-Id: <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
       boundary="i3U80hd1028058.1083312043/relay2.germany.net"
Subject: Returned mail: see transcript for details
Auto-Submitted: auto-generated (failure)
-----

   The ones it doesn't identify however, look like this:

-----
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: Re: Here is the document
Date: Fri, 30 Apr 2004 09:09:16 +0100
MIME-Version: 1.0
Content-Type: multipart/mixed;
       boundary="----=_NextPart_000_0002_00000AE8.000025F7"
X-Priority: 3
X-MSMail-Priority: Normal
-----


   Is that way it won't "see" them?  And if so, how can I save all of 
them with complete headers?  Right now, this is what mimedefang-filter 
has in it:

-----
   if ($FoundVirus) {
       md_graphdefang_log('virus', $VirusName, $RelayAddr);
       md_syslog('warning', "Virus $VirusName found.");
       $QuarantineDir = '/var/spool/MD-Quarantine/virus';
       action_quarantine_entire_message("Message quarantined because of 
virus: $VirusName.");
       $QuarantineDir = '/var/spool/MD-Quarantine';
       return action_discard();
   }
-----

--
W | I haven't lost my mind; it's backed up on tape somewhere.
 +--------------------------------------------------------------------
 Ashley M. Kirchner <mailto:[EMAIL PROTECTED]>   .   303.442.6410 x130
 IT Director / SysAdmin / WebSmith             .     800.441.3873 x130
 Photo Craft Laboratories, Inc.            .     3550 Arapahoe Ave. #6
 http://www.pcraft.com ..... .  .    .       Boulder, CO 80303, U.S.A.


_______________________________________________
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang