The log you're showing is from qmail-scanner with the debug option set. Qmail-scanner supports "silent" notifications if the virus is known to spoof the sender address.
Best regards, Diego d'Ambra -----Original Message----- From: Ted Fines [mailto:[EMAIL PROTECTED] Sent: 20. august 2003 18:04 To: [EMAIL PROTECTED] Subject: Re: [Clamav-users] Configuring mail notifications? Hi David, I thought clamav DID NOT send notifications back to the sender for Sobig and other similar viruses. Here's a snippet from our logs: -- <snip> 20/08/2003 08:25:04:4429: There be a virus! (Worm.Sobig.F) <snip> 20/08/2003 08:25:04:4429: v_v_t_r: called with Worm.Sobig.F 20/08/2003 08:25:04:4429: v_v_t_r: does Worm.Sobig.F contain klez? 20/08/2003 08:25:04:4429: v_v_t_r: does Worm.Sobig.F contain bugbear? 20/08/2003 08:25:04:4429: v_v_t_r: does Worm.Sobig.F contain hybris? 20/08/2003 08:25:04:4429: v_v_t_r: does Worm.Sobig.F contain yaha? 20/08/2003 08:25:04:4429: v_v_t_r: does Worm.Sobig.F contain braid? 20/08/2003 08:25:04:4429: v_v_t_r: does Worm.Sobig.F contain nimda? 20/08/2003 08:25:04:4429: v_v_t_r: does Worm.Sobig.F contain tanatos? 20/08/2003 08:25:04:4429: v_v_t_r: does Worm.Sobig.F contain sobig? 20/08/2003 08:25:04:4429: v_v_t_r: yes it does! - so don't notify the sender <snip> -- Do your logs indicate that clamscan is replying to sobig senders? Ted --On Wednesday, August 20, 2003 5:48 PM +0200 David Jansen <[EMAIL PROTECTED]> wrote: > With the enormous spread of Worm.Sobig.F I was wondering if it would be > possible to turn of the mail notifications that are being sent to the > originating address of the e-mails, especially since many of the recent > virusses (including Worm.Sobig.F) put a fake address in the header. > > I am using clamav-milter from sendmail. As far as I can see I have > nothing configured related to these notifications, so I must be using > default settings. > > Just for completeness, the messages generated look like this: > > Date: Wed, 20 Aug 2003 17:44:15 +0200 > Message-Id: <[EMAIL PROTECTED]> >> From: [EMAIL PROTECTED] > To: <********> > Cc: [EMAIL PROTECTED] > Cc: <[EMAIL PROTECTED]> > Subject: Virus intercepted > > A message you sent to > <[EMAIL PROTECTED]> > contained a virus and has not been delivered. > stream: Worm.Sobig.F FOUND > > > David Jansen > > PS: I am reading this list in digest form so if this question has > already been asked today I apologize. > -- > David Jansen mailto:[EMAIL PROTECTED] > Leiden Observatory ( Sterrewacht Leiden ) > P.O. Box 9513, 2300 RA Leiden, The Netherlands > Phone: (+31) 71 5275810 Fax: (+31) 71 5275819 > > > ------------------------------------------------------- > This SF.net email is sponsored by Dice.com. > Did you know that Dice has over 25,000 tech jobs available today? From > careers in IT to Engineering to Tech Sales, Dice has tech jobs from the > best hiring companies. http://www.dice.com/index.epl?rel_code=104 > _______________________________________________ > Clamav-users mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/clamav-users ------------------------------------------------------- This SF.net email is sponsored by Dice.com. Did you know that Dice has over 25,000 tech jobs available today? From careers in IT to Engineering to Tech Sales, Dice has tech jobs from the best hiring companies. http://www.dice.com/index.epl?rel_code=104 _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users ------------------------------------------------------- This SF.net email is sponsored by Dice.com. Did you know that Dice has over 25,000 tech jobs available today? From careers in IT to Engineering to Tech Sales, Dice has tech jobs from the best hiring companies. http://www.dice.com/index.epl?rel_code4 _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
