> Have a virus scanner that correctly identified the email as having a
> virus attachment, but it still passed along the "cleaned" (ie the
> attachment was removed) email. I was asked if there was a way to
> "trash" the resulting "cleaned" email...
Ah! Different question! Yes, that should be possible, given that you have
the externals set up to trash over a given score. Of course, you could
maybe do this in procmail mor efficiently.
I wouldn't try looking for the executable signature. The newer virui are
smart enough to use random names, or at least multiple names. Also, the
virus scanner could have munged it.
I'd write a header rule or maybe body rule to look for whatever string it is
the virus scannner inserts when it "cleans" a virus.
Loren
