PDA

View Full Version : Email virusscanner please



ChRoNiX
02-09-2004, 04:48 AM
Since I been getting more and more virusses from others by email I really could use a virusscanner.
I'm on an average of 300 virus emails on daily basis now.

I think a procmail based viruscanner would be perfect, just like spamassin does the job for spam email via procmail.

Because I haven't found a sollution so far I'm blocking zip, exe and com (via procmail rules) files too, but the zip really hurts me, because not all zip files are virusses. :(

Does anyone has a sollution .. or Westhost, please help!

FZ
02-10-2004, 01:44 PM
I go through the same thing. I've looked into installing Clam-AV (http://clamav.net/) more than once - but the installation instructions intimidate me - and the fact that because of the way permissions work on our VDS, that it would probably not be possible to get it working anyway.

Here's the next best thing (if a little imprecise): use Procmail to filter out the viruses that come through with a specific subject. Here is the code I use for the MyDoom crap that is going around these days:


:0H:
* ^Subject: (Re: )?(hello|test|hi|server( report)?|error|status|mail (delivery system|transaction failed))$
* > 30000
/dev/null

NOTE: the * ^Subject is all on one line.

Place that in a text file called .procmailrc (yes, it's just an extension, no file name), upload it to your root directory (i.e. / - if via FTP, upload in ASCII format), and then CHMOD it to 644.

In case you do not know, what the above does is match the EXACT subjects (case insensitively) "hello", "re: hello", "test", "re: test" and so on - and then makes sure that the e-mail is also larger than 30kb. If both conditions are fulfilled, the e-mail is automatically, and instantly, trashed. You never even see it. If you receive virii-infected mail with other subjects, just add it on to the above (the | specifies an OR condition).

Good luck.

ChRoNiX
02-11-2004, 03:51 PM
Thanks,

I know how procmail works, but your piece of code was much apprciated.

I've also sent an email to westhost support, requesting a virusscanner. They are looking into it ... i believe.

Hope for the best
Cheers

FZ
02-11-2004, 04:18 PM
No problem - let us know what you find out from WestHost.

ChRoNiX
06-21-2004, 07:01 AM
Haven't got any response from Westhost on this matter.
In the mean time I got the f-prot virusscanner (automatically updates) working on all my email for a couple of weeks now.
The virusscanner is trashing around 300 emails a day ..

WestHost - MMellor
06-21-2004, 10:44 AM
Hello Chronix, Do you have a ticket number on that? You said that we have not got back to you on that. You can PM me that number if you wish.

wiltech
01-21-2005, 07:52 PM
Hello,
I have ClamAV working well on several of my VPSs. You can compile and install the command line version easily with VPS root access. There is a good script, clamassassin, to call clamAV via procmail the same as spamassassin. Then you filter the virus positive emails with procmail.

More detailed information was posted by me in the email forum last May. If you need more info please contact me via email as I don't check these forums often.

Having ClamAV installed and supported by Westhost will be great. In the mean time you can install it yourself fairly simply.

Take Care,
Kalin