Dale, I just added your code to amavisd.conf. Is there a way to test this? -Scott
----- Original Message ----- From: "D Walsh" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, September 27, 2004 8:58 PM Subject: Re: [Clamav-users] New jpeg "virus" and 0.75? > > On Sep 27, 2004, at 23:06, Matthew Daubenspeck wrote: > > > Will there be an updated signature for the new jpeg "virus" for the > > 0.75 > > series of ClamAV? > > You don't say what virus your talking about... try this... it goes in > amavisd,conf in the av_scanner section... copy/paste/save and restart > amavisd > > This appears to be filtering out potentially dangerous JPG Images. > ___________________________________________________ > > # ### http://www.daleenterprise.com/tools/ > ['Dale\'s jpeg-tester', sub {Amavis::AV::ask_av(sub{ > my($f)[EMAIL PROTECTED]; local(*FF,$_,$1,$2); my(@r)=(0,'not jpeg'); > open(FF,$f) or die "jpeg: open err $f: $!"; > binmode(FF) or die "jpeg: binmode err $f: $!"; > read(FF,$_,1000) or die "jpeg: read err $f: $!"; > if (/^\xff\xd8\xff\xe0/ && /\xff\xfe(..)/s) { > my($len) = (unpack("n",$1))-2; > @r = /\xff\xfe..([^\xff]{$len})\xff/s ? (0,"jpeg $f ok, len=$len") > : (1,"bad jpeg $f len=$len FOUND") } # output message on bad file > close(FF) or die "jpeg: close err: $!"; @r}, @_) }, > ["{}/*"], [0], [1], qr/^(.*) FOUND$/ ], > > ___________________________________________________ > > > > -- > > Matthew Daubenspeck > > http://www.oddprocess.org > > > > 23:05:09 up 30 days, 4:58, 1 user, load average: 0.03, 0.06, 0.02 > > > > > > ------------------------------------------------------- > > This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 > > Project Admins to receive an Apple iPod Mini FREE for your judgement on > > who ports your project to Linux PPC the best. Sponsored by IBM. > > Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php > > _______________________________________________ > > Clamav-users mailing list > > [EMAIL PROTECTED] > > https://lists.sourceforge.net/lists/listinfo/clamav-users > > > > > > ------------------------------------------------------- > This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 > Project Admins to receive an Apple iPod Mini FREE for your judgement on > who ports your project to Linux PPC the best. Sponsored by IBM. > Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php > _______________________________________________ > Clamav-users mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/clamav-users ------------------------------------------------------- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement on who ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
