Re: [Clamav-users] SCO virus - Clam 0.65

2004-02-02 Thread Erick Ivaan Lopez Carreon
El mié, 28-01-2004 a las 17:38, Tomasz Papszun escribió: On Wed, 28 Jan 2004 at 16:01:43 -0600, Erick Ivaan Lopez Carreon wrote: I am using Amavis-ng, and the amavisd.conf doesn't seem to have that line in it. However it does seem to know about other ones which spoof the reply,

Re: [Clamav-users] SCO virus - Clam 0.65

2004-01-30 Thread Tomasz Papszun
On Wed, 28 Jan 2004 at 16:01:43 -0600, Erick Ivaan Lopez Carreon wrote: I am using Amavis-ng, and the amavisd.conf doesn't seem to have that line in it. However it does seem to know about other ones which spoof the reply, so i guess it must be somewhere? anybody could give

Re: [Clamav-users] SCO virus - Clam 0.65

2004-01-28 Thread Nigel Horne
On Tuesday 27 Jan 2004 12:53 pm, Brian Read wrote: I am getting lots of these, and clamav is detecting them fine, but it clearly is trying to email back the sender with a notification. As the reply to is spoofed, this makes no sense at all (and i am getting lots of bounces). How do we stop

Re: [Clamav-users] SCO virus - Clam 0.65

2004-01-28 Thread Matt
Yes I'm not sure.. do we put SCO Worm.SCO or Worm.SCO.A in the fake_sender list? On Tue, 2004-01-27 at 10:44, Brian Read wrote: At 14:57 27/01/2004, you wrote: Brian Read wrote: I am getting lots of these, and clamav is detecting them fine, but it clearly is trying to email back the sender

Re: [Clamav-users] SCO virus - Clam 0.65

2004-01-28 Thread Andrzej Zawadzki
Brian Read wrote: At 14:57 27/01/2004, you wrote: I am using Amavis-ng, and the amavisd.conf doesn't seem to have that line in it. However it does seem to know about other ones which spoof the reply, so i guess it must be somewhere? Probabli... but try to change to amavisd-new, I thing is

Re: [Clamav-users] SCO virus - Clam 0.65

2004-01-28 Thread Thomas Lamy
Andrzej Zawadzki wrote: Brian Read wrote: At 14:57 27/01/2004, you wrote: I am using Amavis-ng, and the amavisd.conf doesn't seem to have that line in it. However it does seem to know about other ones which spoof the reply, so i guess it must be somewhere? Probabli... but try to change to

Re: [Clamav-users] SCO virus - Clam 0.65

2004-01-28 Thread Erick Ivaan Lopez Carreon
El mié, 28-01-2004 a las 06:58, Thomas Lamy escribió: Andrzej Zawadzki wrote: Brian Read wrote: At 14:57 27/01/2004, you wrote: I am using Amavis-ng, and the amavisd.conf doesn't seem to have that line in it. However it does seem to know about other ones which spoof the reply,

[Clamav-users] SCO virus - Clam 0.65

2004-01-27 Thread Brian Read
I am getting lots of these, and clamav is detecting them fine, but it clearly is trying to email back the sender with a notification. As the reply to is spoofed, this makes no sense at all (and i am getting lots of bounces). How do we stop this happening? Cheers Brian -- Brian J Read

Re: [Clamav-users] SCO virus - Clam 0.65

2004-01-27 Thread Thomas Lamy
Brian Read wrote: I am getting lots of these, and clamav is detecting them fine, but it clearly is trying to email back the sender with a notification. As the reply to is spoofed, this makes no sense at all (and i am getting lots of bounces). How do we stop this happening? Cheers Brian Which

Re: [Clamav-users] SCO virus - Clam 0.65

2004-01-27 Thread Mick Pollard
Hi, I call spamc from amavisd-new. amavisd-new has an option to not send notification based on a regexp. How are you using clam ?? Regards Mick Pollard ( lunix ) snip $viruses_that_fake_sender_re = new_RE( qr'nimda|hybris|klez|bugbear|Bagle|yaha|braid|sobig|fizzer|palyh|peido|holar'i ,

Re: [Clamav-users] SCO virus - Clam 0.65

2004-01-27 Thread Andrzej Zawadzki
Brian Read wrote: I am getting lots of these, and clamav is detecting them fine, but it clearly is trying to email back the sender with a notification. As the reply to is spoofed, this makes no sense at all (and i am getting lots of bounces). How do we stop this happening? I'm using

Re: [Clamav-users] SCO virus - Clam 0.65

2004-01-27 Thread Brian Read
At 14:57 27/01/2004, you wrote: Brian Read wrote: I am getting lots of these, and clamav is detecting them fine, but it clearly is trying to email back the sender with a notification. As the reply to is spoofed, this makes no sense at all (and i am getting lots of bounces). How do we stop this

Re: [Clamav-users] SCO virus - Clam 0.65

2004-01-27 Thread Lionel Bouton
Brian Read wrote the following on 01/27/2004 01:53 PM : I am getting lots of these, and clamav is detecting them fine, but it clearly is trying to email back the sender with a notification. As the reply to is spoofed, this makes no sense at all (and i am getting lots of bounces). How do we

Re: [Clamav-users] SCO virus - Clam 0.65

2004-01-27 Thread Tomasz Papszun
On Tue, 27 Jan 2004 at 12:53:54 +, Brian Read wrote: I am getting lots of these, and clamav is detecting them fine, but it clearly is trying to email back the sender with a notification. As the reply to is spoofed, this makes no sense at all (and i am getting Sure! lots of bounces).

Re: [Clamav-users] SCO virus - Clam 0.65

2004-01-27 Thread christian laubscher
As the reply to is spoofed, this makes no sense at all (and i am getting lots of bounces). How do we stop this happening? if it's clamav-milter: - do away with the smfi_setreply statement (at or near line 1524) - set 'rc = SMFIS_DISCARD;' (instead of SMFID_REJECT) (at or near line 1522)