Re: [Qmail-scanner-general]Stopping Worm.SCO.A notifications to sender and admin

[Salvatore Toribio]

Sean D. wrote:
James Herschel wrote:

I've added 'sco' to @silent_viruses_array in the hopes of curbing some of
the alerts I'm receiving.  I noticed that the comment for this array says
"... virus that we don't want to inform the SENDER of".  Does this mean that
the admin will receive them no matter what?
If so, is there another way to stop these?

Thanks!

James


i would also like to know how to add these to the silent_vruses 
array to shut up these alerts... also i believe this is another one 
of these worms that spoofs the from address so the replies sent to 
the sender wont be accurate either.

anyone?

thanks in advance,
Sean
You can't stop 'all' the notifications of myDoom/sco, you can only 
stop ALL the notifications by editing 
/var/qmail/bin/qmail-scanner-queue.pl and setting this:

#Addresses that should be alerted of any quarantined Email
my $NOTIFY_ADDRS='none';
Yesterday I've posted a modification to the code that you can add 
editing /var/qmail/bin/qmail-scanner-queue.pl that stops the 
notification and doesn't quarantine the file, search the first part 
of the code below and add the second part:

AFTER THIS CODE:

  #Now, start the scanners!
  #if (!$quarantine_event) {
    &init_scanners;
  #}
INSERT:

  # MyDoom
  if ($quarantine_description=~/doom|sco/i) {
    &debug("myDoom: Another myDoom virus, dropping");
    #&minidebug("myDoom: Another myDoom virus, dropping");
    &cleanup;
    &debug("--- all finished. Total of ",tv_interval ($start_time, 
[gettimeofday])," secs");
    #&minidebug("------ Process $$ finished. Total of ",tv_interval 
($start_time, [gettimeofday])," secs");
    close(LOG);
    exit 0;
  }

Remember that all the lines must finish in a ";" or "{" or "}" so pay 
attention to the lines that your mailer will wrap...

If you are using version "1.20st", you can uncomment the "minidebug" lines.

I don't know why, but the post I send to the list always take several 
hours before they are resent (?)

Cheers

Salvatore

-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Qmail-scanner-general mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general