On Wed, 20 Aug 2003 at 20:38:33 +0100, Antony Stone wrote: > On Wednesday 20 August 2003 4:48 pm, David Jansen wrote: > > > With the enormous spread of Worm.Sobig.F I was wondering if it would be > > possible to turn of the mail notifications that are being sent to the > > originating address of the e-mails, especially since many of the recent > > virusses (including Worm.Sobig.F) put a fake address in the header. > > > > I am using clamav-milter from sendmail. As far as I can see I have > > nothing configured related to these notifications, so I must be using > > default settings. > > MailScanner (http://www.mailscanner.info) has a list of "Silent Viruses" in > response to which it will not send notifications to the (apparent but false) > sender. [...]
David, I don't know if it's usable for your particular system, but I'm writing "just in case". Another good interface between MTA and AVs is amavisd-new ( http://www.ijs.si/software/amavisd/ ). To avoid sending notifications/bounces to faked addresses it uses viruses_that_fake_sender_re (mine contains: nimda|hybris|klez|bugbear|yaha|braid|sobig|fizzer|palyh|peido|holar|dropper.c) Amavisd-new works also with Spamassassin. Moreover, it can work with many AVs in one setup (it gives a message to one scanner, then to the second one and so on). Also, it can use "backup scanners" in case main scanners fail for some reason. I use it and I'm very pleased with it. -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only [EMAIL PROTECTED] http://www.lodz.tpsa.pl/ | ones and zeros. ------------------------------------------------------- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
