Re: [AMaViS-user] virus names

2006-11-16 Thread Mark Martinec
MK,

> when using different virus scanners and a virus is found on
> more than one scanners, is it possible to tell amavisd-new
> which virus name to choose?

By rearranging the order of virus scanners in the @av_scanners list:

amavisd.conf-sample:

# - the order matters: although _all_ available entries from the list
#   are tried regardless of their verdict, scanners are run in the order
#   specified: the report from the first one detecting a virus will be used
#   (providing virus names and scanner output); REARRANGE THE ORDER TO WILL;

> is there an easy way to extra tag the foud viruses strings with
> infos about what scanner detected it?
> for example "W32/Stration.dr -> [NAI] W32/Stration.dr" or
> "Worm.SomeFool.P -> [ClamAV] Worm.SomeFool.P"

You will need to apply a small modification to the program
(patch is against 2.4.4-rc2, should apply to earlier versions
too with some offset):

--- amavisd.origWed Nov 15 19:17:17 2006
+++ amavisd Thu Nov 16 14:47:26 2006
@@ -15390,7 +15390,8 @@
 $j++; section_time("AV-scan-$j");
 if ($this_status) {  # virus detected by this scanner
-  push(@detecting_scanners, $av->[0]);
+  my($scanner_name) = $av->[0];
+  push(@detecting_scanners, $scanner_name);
   if ([EMAIL PROTECTED]) { # store results of the first scanner detecting
-@virusname = @$this_vn;
+@virusname = map { sprintf("[%s] %s",$scanner_name,$_) } @$this_vn;
 $scan_status = $this_status; $output = $this_output;
   }


Mark

-
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


[AMaViS-user] virus names

2006-11-16 Thread MK [ [EMAIL PROTECTED] ]
when using different virus scanners and a virus is found on
more than one scanners, is it possible to tell amavisd-new
which virus name to choose?

is there an easy way to extra tag the foud viruses strings with
infos about what scanner detected it?
for example "W32/Stration.dr -> [NAI] W32/Stration.dr" or
"Worm.SomeFool.P -> [ClamAV] Worm.SomeFool.P"


-
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/