[Qmail-scanner-general]env_from for virus message

2006-04-05 Thread john crawford
Hi all. Hi Jason. There's probably a good reason for it, but I was wondering why Jason's code doesn't insert the virus from address into the qmail-inject call in qmail-scanner-queue.pl which generates the quarantine report. I noticed the envelope-from wasn't set. open(SM,"|$qmailinject -h -f

[Qmail-scanner-general]admin notification suppressed when sender is "unreplyable"

2005-06-27 Thread john crawford
Hi. In 1.25, I'm seeing admin not notified of viruses if the sender is unreplyable (addresses matches "owner" for example). I've configured for --notify sender,admin. If sender matches the mailing-list criterion, it also suppresses notification of the admin. &email_sender("admin"); calls s

Re: [Qmail-scanner-general]Bagle-h and password protected ZIP files

2004-03-03 Thread john crawford
At 10:18 PM 3/2/2004, Trey Nolen wrote: > Thanks for posting your quarantine-attachments.txt entries. I had a few of > those, but the list sure helped. Also, add: > Information.zip0 Bagle-H/I Thanks. The list I got came from Sophos at: http://www.sophos.com/virusinfo/analyses/w32ba

Re: [Qmail-scanner-general]Bagle-h and password protected ZIP files

2004-03-03 Thread john crawford
At 03:52 PM 3/2/2004, Jason Haar wrote: On Wed, 2004-03-03 at 07:17, CertaintyTech-Ed wrote: > Anyone else seeing the Bagle-H virus getting thru? I am using Q-S and > sophie and it is not stopping them. Sophie sees that the ZIP file is > password encrypted so can't check it for viruses and Q-S go

[Qmail-scanner-general]chasing silent viruses updates

2004-02-23 Thread john crawford
Hi. Here's a thought I have not seen expressed here previously. Some anti-virus software uses the "@mm" string naming convention when a virus is found which carries it's own smtp engine. I've not found a rigorous definition of virus naming conventions, but given this observation - I think ad

[Qmail-scanner-general]exact size of zero, perlscanner logic

2003-09-25 Thread John Crawford
Hi, I'm running v1.16. It would be nice to be able to have perlscanner logic be able to match an attachment size of zero. As it now sits, zero is used to indicate no-size specified. If we used a negative number to specify ignore size, then zero could be matched, which could be helpful in some si

Re: [Qmail-scanner-general]Sobig.F and attachment type

2003-08-20 Thread john crawford
At 02:14 PM 8/20/2003, Greg Kelley wrote: Folks, So far today we have trapped over 400 infected emails with the Sobig.F attachment. Because this is getting recognized first as a disallowed attachment type, an email to the 'sender' is getting generated which just adds to the millions of emails alre

Re: [Qmail-scanner-general]oddity with header breakage analysis code

2003-07-28 Thread john crawford
At 11:51 PM 7/2/2003, Jason Haar wrote: Arg. The Q-S code in question is blocking for what it thinks is a valid reason, but then it skips to the next line - i.e. the invalid line doesn't get written out... Buglet: the intent is still correct, but this is sure making debugging difficult. I'll see wh

Re: [Qmail-scanner-general]qmail-scanner with two antivirus

2003-07-03 Thread John Crawford
At 08:05 AM 7/3/2003, Ron Culler wrote: Qmail-scanner will execute each scannner in the order they are placed in the qmail-scanner-queue.pl file my @scanner_array=("scanner1" , "scanner2") Perlscanner runs first then scanner1 and finally scanner2. If a scanner does detect a virus/quarantine event,

Re: [Qmail-scanner-general]oddity with header breakage analysis code

2003-07-02 Thread John Crawford
At 10:31 PM 7/2/2003, Jason wrote: On Wed, Jul 02, 2003 at 09:55:20PM -0400, John Crawford wrote: > Hi. > > A campus department sent out messages today that (each new one) > kept triggering the > $quarantine_description='Illegal breakage found in header name - potential &

[Qmail-scanner-general]oddity with header breakage analysis code

2003-07-02 Thread John Crawford
Hi. A campus department sent out messages today that (each new one) kept triggering the $quarantine_description='Illegal breakage found in header name - potential virus'; part of the qmail-scanner-queue code. I'm running stock v1.16 here with bad_mime = 1. If I look at the perl code and what's d

Re: [Qmail-scanner-general]return codes and qmail-qfilter environment

2003-07-02 Thread john crawford
At 10:13 PM 6/22/2003, John Crawford wrote: Hi. I'm using the qmail-qfilter program to call qmail-queue. qmail-scanner is calling qmail-qfilter. As the qmail program is written, it supports the return code of 31 to indicate permanent failure. (I direct you to the ending lines of qmail.c s

Re: [Qmail-scanner-general]silent_viruses: v scan before suffix check desired

2003-06-26 Thread John Crawford
At 06:23 PM 6/26/2003, Jason Haar wrote: On Wed, Jun 25, 2003 at 04:53:22PM -0400, john crawford wrote: > Developers: > > We are blocking with quarantine-attachments.txt, certain > suffixes. It would be nice if the virus checking logic would > run and make a response before the

RE: [Qmail-scanner-general]unzipping and uvscan

2003-06-26 Thread john crawford
At 10:01 AM 6/26/2003, Dallas L. Engelken wrote: > -Original Message- > From: John Crawford [mailto:[EMAIL PROTECTED] > Sent: Wednesday, June 25, 2003 9:27 PM > To: [EMAIL PROTECTED] > Subject: [Qmail-scanner-general]unzipping and uvscan > > > Hi. > > qmai

[Qmail-scanner-general]unzipping and uvscan

2003-06-25 Thread John Crawford
Hi. qmail-scanner 1.16 source comments seem to think mcafee's uvscan does not unzip. I think recent versions I've encountered do unzip. Does anyone have recent experience to the contrary? Perhaps the source should be modified in this regard. Also, I've discovered that with $force_unzip of true (or

Re: [Qmail-scanner-general]return codes and qmail-qfilter environment

2003-06-25 Thread John Crawford
At 10:13 PM 6/22/2003, I wrote: Hi. I'm using the qmail-qfilter program to call qmail-queue. qmail-scanner is calling qmail-qfilter. As the qmail program is written, it supports the return code of 31 to indicate permanent failure. (I direct you to the ending lines of qmail.c source. Also, the doc

[Qmail-scanner-general]silent_viruses: v scan before suffix check desired

2003-06-25 Thread john crawford
Developers: We are blocking with quarantine-attachments.txt, certain suffixes. It would be nice if the virus checking logic would run and make a response before the suffix check is (optionally) called. For silent_viruses (where the sender information is bogus) qmail-scanner would then not unneces

[Qmail-scanner-general]return codes and qmail-qfilter environment

2003-06-22 Thread John Crawford
Hi. I'm using the qmail-qfilter program to call qmail-queue. qmail-scanner is calling qmail-qfilter. As the qmail program is written, it supports the return code of 31 to indicate permanent failure. (I direct you to the ending lines of qmail.c source. Also, the docs of qmail-qfilter are helpful h