Brian Read wrote:I am getting lots of these, and clamav is detecting them fine, but it clearly is trying to email back the "sender" with a notification.
As the reply to is spoofed, this makes no sense at all (and i am getting lots of bounces). How do we stop this happening?
I'm using amavisd-new-20030616-4 and in /etc/amavisd.conf I have:
# Treat envelope sender address as unreliable and don't send sender # notification / bounces if name(s) of detected virus(es) match the #list. # Note that virus names are supplied by external virus scanner(s) and #are # not standardized, so virus names may need to be adjusted. # See README.lookups for syntax. # $viruses_that_fake_sender_re = new_RE( qr'nimda|hybris|klez|bugbear|yaha|braid|sobig|fizzer|palyh|peido|holar'i, qr'tanatos|lentin|bridex|mimail|trojan\.dropper|bagle|SCO'i, );
and with this I have:
A virus (Worm.SCO.A) was found.
Scanner detecting a virus: Clam Antivirus-clamd
The mail originated from: <[EMAIL PROTECTED]>
Notification to sender will not be mailed.
I am using Amavis-ng, and the amavisd.conf doesn't seem to have that line in it. However it does seem to know about other ones which spoof the reply, so i guess it must be somewhere?
Cheers
Brian -- Brian J Read www.abandonmicrosoft.co.uk www.theonlineorganiser.com www.thepersonalknowledgebase.com +44 1695 723723
------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
