Yes I'm not sure.. do we put SCO Worm.SCO or Worm.SCO.A in the fake_sender list?
On Tue, 2004-01-27 at 10:44, Brian Read wrote: > At 14:57 27/01/2004, you wrote: > >Brian Read wrote: > >>I am getting lots of these, and clamav is detecting them fine, but it > >>clearly is trying to email back the "sender" with a notification. > >>As the reply to is spoofed, this makes no sense at all (and i am getting > >>lots of bounces). How do we stop this happening? > > > >I'm using amavisd-new-20030616-4 and in /etc/amavisd.conf > >I have: > > > ># Treat envelope sender address as unreliable and don't send sender > ># notification / bounces if name(s) of detected virus(es) match the #list. > ># Note that virus names are supplied by external virus scanner(s) and #are > ># not standardized, so virus names may need to be adjusted. > ># See README.lookups for syntax. > ># > >$viruses_that_fake_sender_re = new_RE( > > qr'nimda|hybris|klez|bugbear|yaha|braid|sobig|fizzer|palyh|peido|holar'i, > > qr'tanatos|lentin|bridex|mimail|trojan\.dropper|bagle|SCO'i, > >); > > > > > >and with this I have: > > > >A virus (Worm.SCO.A) was found. > > > >Scanner detecting a virus: Clam Antivirus-clamd > > > >The mail originated from: <[EMAIL PROTECTED]> > > > >Notification to sender will not be mailed. > > > I am using Amavis-ng, and the amavisd.conf doesn't seem to have that line > in it. However it does seem to know about other ones which spoof the > reply, so i guess it must be somewhere? > > > Cheers > > Brian -- Matt <[EMAIL PROTECTED]> ------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
